aws_instance resource sets IMDS session auth tokens to be optional.
+To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.
+
+
+### Impact
+Instance metadata service can be interacted with freely
+
+
+{{ remediationActions }}
+
+### Links
+- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md
new file mode 100644
index 0000000..361b833
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md
@@ -0,0 +1,24 @@
+
+Remove sensitive data from the EC2 instance user-data
+
+```yaml---
+Resources:
+ GoodExample:
+ Type: AWS::EC2::Instance
+ Properties:
+ ImageId: "ami-79fd7eee"
+ KeyName: "testkey"
+ UserData: export SSM_PATH=/database/creds
+ BlockDeviceMappings:
+ - DeviceName: "/dev/sdm"
+ Ebs:
+ VolumeType: "io1"
+ Iops: "200"
+ DeleteOnTermination: "false"
+ VolumeSize: "20"
+ - DeviceName: "/dev/sdk"
+
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md
new file mode 100644
index 0000000..8136496
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md
@@ -0,0 +1,24 @@
+
+Remove sensitive data from the EC2 instance user-data
+
+```hcl
+ resource "aws_iam_instance_profile" "good_example" {
+ // ...
+ }
+
+ resource "aws_instance" "good_example" {
+ ami = "ami-12345667"
+ instance_type = "t2.small"
+
+ iam_instance_profile = aws_iam_instance_profile.good_profile.arn
+
+ user_data = <aws_instance resource sets IMDS session auth tokens to be optional.
+To fully protect IMDS you need to enable session tokens by using metadata_options block and its http_tokens variable set to required.
+
+
+### Impact
+Instance metadata service can be interacted with freely
+
+
+{{ remediationActions }}
+
+### Links
+- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/CloudFormation.md
new file mode 100644
index 0000000..8db6bf7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/CloudFormation.md
@@ -0,0 +1,24 @@
+
+Turn on encryption for all block devices
+
+```yaml---
+Resources:
+ GoodExample:
+ Type: AWS::EC2::Instance
+ Properties:
+ ImageId: "ami-79fd7eee"
+ KeyName: "testkey"
+ UserData: export SSM_PATH=/database/creds
+ BlockDeviceMappings:
+ - DeviceName: "/dev/sdm"
+ Ebs:
+ Encrypted: True
+ VolumeType: "io1"
+ Iops: "200"
+ DeleteOnTermination: "false"
+ VolumeSize: "20"
+
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/Terraform.md
new file mode 100644
index 0000000..9e316c8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/Terraform.md
@@ -0,0 +1,26 @@
+
+Turn on encryption for all block devices
+
+```hcl
+resource "aws_instance" "good_example" {
+ ami = "ami-7f89a64f"
+ instance_type = "t1.micro"
+
+ root_block_device {
+ encrypted = true
+ }
+
+ ebs_block_device {
+ device_name = "/dev/sdg"
+ volume_size = 5
+ volume_type = "gp2"
+ delete_on_termination = false
+ encrypted = true
+ }
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#ebs-ephemeral-and-root-block-devices
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/docs.md
new file mode 100644
index 0000000..3d9ac8d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0131/docs.md
@@ -0,0 +1,13 @@
+
+Block devices should be encrypted to ensure sensitive data is held securely at rest.
+
+### Impact
+The block device could be compromised and read from
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/CloudFormation.md
new file mode 100644
index 0000000..3593a59
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/CloudFormation.md
@@ -0,0 +1,13 @@
+
+Set the instance to not be publicly accessible
+
+```yaml---
+Resources:
+ GoodExample:
+ Properties:
+ VpcId: vpc-123456
+ Type: AWS::EC2::Subnet
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/Terraform.md
new file mode 100644
index 0000000..c51b0e2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/Terraform.md
@@ -0,0 +1,14 @@
+
+Set the instance to not be publicly accessible
+
+```hcl
+ resource "aws_subnet" "good_example" {
+ vpc_id = "vpc-123456"
+ map_public_ip_on_launch = false
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/docs.md
new file mode 100644
index 0000000..2efd40e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0164/docs.md
@@ -0,0 +1,13 @@
+
+You should limit the provision of public IP addresses for resources. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application.
+
+### Impact
+The instance is publicly accessible
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0173/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0173/docs.md
new file mode 100644
index 0000000..3b6d4ca
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0173/docs.md
@@ -0,0 +1,17 @@
+
+
+Configuring all VPC default security groups to restrict all traffic will encourage least
+privilege security group development and mindful placement of AWS resources into
+security groups which will in-turn reduce the exposure of those resources.
+
+
+### Impact
+Easier to accidentally expose resources - goes against principle of least privilege
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/default-custom-security-groups.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0178/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0178/docs.md
new file mode 100644
index 0000000..775832f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ec2/AVD-AWS-0178/docs.md
@@ -0,0 +1,13 @@
+
+VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.
+
+### Impact
+Without VPC flow logs, you risk not having enough information about network traffic flow to investigate incidents or identify security issues.
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/CloudFormation.md
new file mode 100644
index 0000000..a1d034a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/CloudFormation.md
@@ -0,0 +1,19 @@
+
+Enable ECR image scanning
+
+```yaml---
+Resources:
+ GoodExample:
+ Type: AWS::ECR::Repository
+ Properties:
+ RepositoryName: "test-repository"
+ ImageTagImmutability: IMMUTABLE
+ ImageScanningConfiguration:
+ ScanOnPush: True
+ EncryptionConfiguration:
+ EncryptionType: KMS
+ KmsKey: "alias/ecr-key"
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/Terraform.md
new file mode 100644
index 0000000..0e23e9a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/Terraform.md
@@ -0,0 +1,18 @@
+
+Enable ECR image scanning
+
+```hcl
+ resource "aws_ecr_repository" "good_example" {
+ name = "bar"
+ image_tag_mutability = "MUTABLE"
+
+ image_scanning_configuration {
+ scan_on_push = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_scanning_configuration
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/docs.md
new file mode 100644
index 0000000..cacc98e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0030/docs.md
@@ -0,0 +1,13 @@
+
+Repository image scans should be enabled to ensure vulnerable software can be discovered and remediated as soon as possible.
+
+### Impact
+The ability to scan images is not being used and vulnerabilities will not be highlighted
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/CloudFormation.md
new file mode 100644
index 0000000..842d1c7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/CloudFormation.md
@@ -0,0 +1,19 @@
+
+Only use immutable images in ECR
+
+```yaml---
+Resources:
+ GoodExample:
+ Type: AWS::ECR::Repository
+ Properties:
+ RepositoryName: "test-repository"
+ ImageTagMutability: IMMUTABLE
+ ImageScanningConfiguration:
+ ScanOnPush: false
+ EncryptionConfiguration:
+ EncryptionType: KMS
+ KmsKey: "alias/ecr-key"
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/Terraform.md
new file mode 100644
index 0000000..5ef303e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/Terraform.md
@@ -0,0 +1,18 @@
+
+Only use immutable images in ECR
+
+```hcl
+ resource "aws_ecr_repository" "good_example" {
+ name = "bar"
+ image_tag_mutability = "IMMUTABLE"
+
+ image_scanning_configuration {
+ scan_on_push = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/docs.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/docs.md
new file mode 100644
index 0000000..f7d3079
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0031/docs.md
@@ -0,0 +1,15 @@
+
+ECR images should be set to IMMUTABLE to prevent code injection through image mutation.
+
+This can be done by setting image_tab_mutability to IMMUTABLE
+
+### Impact
+Image tags could be overwritten with compromised images
+
+
+{{ remediationActions }}
+
+### Links
+- https://sysdig.com/blog/toctou-tag-mutability/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/CloudFormation.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/CloudFormation.md
new file mode 100644
index 0000000..08fb123
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/CloudFormation.md
@@ -0,0 +1,36 @@
+
+Do not allow public access in the policy
+
+```yaml---
+Resources:
+ GoodExample:
+ Type: AWS::ECR::Repository
+ Properties:
+ RepositoryName: "test-repository"
+ ImageTagImmutability: IMMUTABLE
+ ImageScanningConfiguration:
+ ScanOnPush: false
+ EncryptionConfiguration:
+ EncryptionType: KMS
+ KmsKey: "alias/ecr-key"
+ RepositoryPolicyText:
+ Version: "2012-10-17"
+ Statement:
+ -
+ Sid: AllowPushPull
+ Effect: Allow
+ Principal:
+ AWS:
+ - "arn:aws:iam::123456789012:user/Alice"
+ Action:
+ - "ecr:GetDownloadUrlForLayer"
+ - "ecr:BatchGetImage"
+ - "ecr:BatchCheckLayerAvailability"
+ - "ecr:PutImage"
+ - "ecr:InitiateLayerUpload"
+ - "ecr:UploadLayerPart"
+ - "ecr:CompleteLayerUpload"
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/Terraform.md b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/Terraform.md
new file mode 100644
index 0000000..8cd602b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/aws/ecr/AVD-AWS-0032/Terraform.md
@@ -0,0 +1,46 @@
+
+Do not allow public access in the policy
+
+```hcl
+ resource "aws_ecr_repository" "foo" {
+ name = "bar"
+ }
+
+ resource "aws_ecr_repository_policy" "foopolicy" {
+ repository = aws_ecr_repository.foo.name
+
+ policy = <encryption_settings block, the enabled attribute should be set to true.
+
+### Impact
+Data could be read if compromised
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/Terraform.md
new file mode 100644
index 0000000..8295eff
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/Terraform.md
@@ -0,0 +1,43 @@
+
+Use ssh authentication for virtual machines
+
+```hcl
+ resource "azurerm_linux_virtual_machine" "good_linux_example" {
+ name = "good-linux-machine"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ size = "Standard_F2"
+ admin_username = "adminuser"
+ admin_password = "somePassword"
+
+ admin_ssh_key {
+ username = "adminuser"
+ public_key = file("~/.ssh/id_rsa.pub")
+ }
+ }
+
+ resource "azurerm_virtual_machine" "good_example" {
+ name = "good-linux-machine"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ size = "Standard_F2"
+ admin_username = "adminuser"
+
+
+ os_profile_linux_config {
+ ssh_keys = [{
+ key_data = file("~/.ssh/id_rsa.pub")
+ path = "~/.ssh/id_rsa.pub"
+ }]
+
+ disable_password_authentication = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine#disable_password_authentication
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine#disable_password_authentication
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/docs.md
new file mode 100644
index 0000000..e89c684
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/compute/AVD-AZU-0039/docs.md
@@ -0,0 +1,10 @@
+
+Access to virtual machines should be authenticated using SSH keys. Removing the option of password authentication enforces more secure methods while removing the risks inherent with passwords.
+
+### Impact
+Using password authentication is less secure that ssh keys may result in compromised servers
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/Terraform.md
new file mode 100644
index 0000000..1a65b18
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/Terraform.md
@@ -0,0 +1,25 @@
+
+Enable logging for AKS
+
+```hcl
+ resource "azurerm_kubernetes_cluster" "good_example" {
+ addon_profile {
+ oms_agent {
+ enabled = true
+ }
+ }
+ }
+
+```
+```hcl
+ resource "azurerm_kubernetes_cluster" "good_example" {
+ oms_agent {
+ log_analytics_workspace_id = "whatever"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#oms_agent
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/docs.md
new file mode 100644
index 0000000..8e6e32d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0040/docs.md
@@ -0,0 +1,13 @@
+
+Ensure AKS logging to Azure Monitoring is configured for containers to monitor the performance of workloads.
+
+### Impact
+Logging provides valuable information about access and usage
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/azure-monitor/insights/container-insights-onboard
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/Terraform.md
new file mode 100644
index 0000000..1eddde6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/Terraform.md
@@ -0,0 +1,19 @@
+
+Limit the access to the API server to a limited IP range
+
+```hcl
+ resource "azurerm_kubernetes_cluster" "good_example" {
+ api_server_access_profile {
+ authorized_ip_ranges = [
+ "1.2.3.4/32"
+ ]
+
+ }
+
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#authorized_ip_ranges
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/docs.md
new file mode 100644
index 0000000..01da3e2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0041/docs.md
@@ -0,0 +1,13 @@
+
+The API server is the central way to interact with and manage a cluster. To improve cluster security and minimize attacks, the API server should only be accessible from a limited set of IP address ranges.
+
+### Impact
+Any IP can interact with the API server
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/Terraform.md
new file mode 100644
index 0000000..bb09686
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/Terraform.md
@@ -0,0 +1,57 @@
+
+Enable RBAC
+
+```hcl
+ resource "azurerm_kubernetes_cluster" "good_example" {
+ // azurerm < 2.99.0
+ role_based_access_control {
+ enabled = true
+ }
+
+ // azurerm >= 2.99.0
+ role_based_access_control_enabled = true
+ }
+
+```
+```hcl
+resource "azurerm_kubernetes_cluster" "aks_cluster" {
+ name = var.name
+ location = var.location
+ resource_group_name = var.resource_group_name
+ dns_prefix = var.name
+ kubernetes_version = var.cluster_version
+ api_server_authorized_ip_ranges = var.ip_whitelist
+ azure_policy_enabled = true
+ default_node_pool {
+ name = "default"
+ enable_auto_scaling = true
+ min_count = var.node_min_count
+ max_count = var.node_max_count
+ max_pods = var.pod_max_count # If you don't specify only allows 30 pods
+ vm_size = var.vm_size
+ os_disk_size_gb = 250 # default 30GB
+ vnet_subnet_id = var.vnet_subnet_id
+ }
+
+ network_profile {
+ network_plugin = "azure"
+ network_policy = "azure"
+ }
+
+ identity {
+ type = "SystemAssigned"
+ }
+
+ azure_active_directory_role_based_access_control {
+ managed = true
+ azure_rbac_enabled = true
+ admin_group_object_ids = [data.azuread_group.aks_admins.object_id]
+ }
+
+}
+
+```
+
+#### Remediation Links
+ - https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#role_based_access_control
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/docs.md
new file mode 100644
index 0000000..92d7cca
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0042/docs.md
@@ -0,0 +1,13 @@
+
+Using Kubernetes role-based access control (RBAC), you can grant users, groups, and service accounts access to only the resources they need.
+
+### Impact
+No role based access control is in place for the AKS cluster
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/aks/concepts-identity
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/Terraform.md
new file mode 100644
index 0000000..ffa1276
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/Terraform.md
@@ -0,0 +1,15 @@
+
+Configure a network policy
+
+```hcl
+ resource "azurerm_kubernetes_cluster" "good_example" {
+ network_profile {
+ network_policy = "calico"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#network_policy
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/docs.md
new file mode 100644
index 0000000..25936a7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/container/AVD-AZU-0043/docs.md
@@ -0,0 +1,13 @@
+
+The Kubernetes object type NetworkPolicy should be defined to have opportunity allow or block traffic to pods, as in a Kubernetes cluster configured with default settings, all pods can discover and communicate with each other without any restrictions.
+
+### Impact
+No network policy is protecting the AKS cluster
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/services-networking/network-policies
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/Terraform.md
new file mode 100644
index 0000000..288e9a4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/Terraform.md
@@ -0,0 +1,22 @@
+
+Provide at least one email address for threat alerts
+
+```hcl
+ resource "azurerm_mssql_server_security_alert_policy" "good_example" {
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_sql_server.example.name
+ state = "Enabled"
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ disabled_alerts = [
+ "Sql_Injection",
+ "Data_Exfiltration"
+ ]
+ email_addresses = ["db-security@acme.org"]
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#email_addresses
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/docs.md
new file mode 100644
index 0000000..7eccceb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0018/docs.md
@@ -0,0 +1,10 @@
+
+SQL Server sends alerts for threat detection via email, if there are no email addresses set then mitigation will be delayed.
+
+### Impact
+Nobody will be promptly alerted in the case of a threat being detected
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/Terraform.md
new file mode 100644
index 0000000..6f264c5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/Terraform.md
@@ -0,0 +1,37 @@
+
+Enable connection logging
+
+```hcl
+ resource "azurerm_resource_group" "example" {
+ name = "example-resources"
+ location = "West Europe"
+ }
+
+ resource "azurerm_postgresql_server" "example" {
+ name = "example-psqlserver"
+ location = azurerm_resource_group.example.location
+ resource_group_name = azurerm_resource_group.example.name
+
+ administrator_login = "psqladminun"
+ administrator_login_password = "H@Sh1CoR3!"
+
+ sku_name = "GP_Gen5_4"
+ version = "9.6"
+ storage_mb = 640000
+ }
+
+ resource "azurerm_postgresql_configuration" "example" {
+ name = "log_connections"
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_postgresql_server.example.name
+ value = "on"
+ }
+
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration
+
+ - https://docs.microsoft.com/en-us/azure/postgresql/concepts-server-logs#configure-logging
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/docs.md
new file mode 100644
index 0000000..5f3cc1a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0019/docs.md
@@ -0,0 +1,13 @@
+
+Postgresql can generate logs for successful connections to improve visibility for audit and configuration issue resolution.
+
+### Impact
+No visibility of successful connections
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/postgresql/concepts-server-logs#configure-logging
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/Terraform.md
new file mode 100644
index 0000000..e1c54cd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable SSL enforcement
+
+```hcl
+ resource "azurerm_postgresql_server" "good_example" {
+ name = "good_example"
+
+ public_network_access_enabled = false
+ ssl_enforcement_enabled = true
+ ssl_minimal_tls_version_enforced = "TLS1_2"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#ssl_enforcement_enabled
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#ssl_enforcement_enabled
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mariadb_server#ssl_enforcement_enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/docs.md
new file mode 100644
index 0000000..c6f32a4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0020/docs.md
@@ -0,0 +1,10 @@
+
+SSL connections should be enforced were available to ensure secure transfer and reduce the risk of compromising data in flight.
+
+### Impact
+Insecure connections could lead to data loss and other vulnerabilities
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/Terraform.md
new file mode 100644
index 0000000..94895ff
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/Terraform.md
@@ -0,0 +1,35 @@
+
+Enable connection throttling logging
+
+```hcl
+ resource "azurerm_resource_group" "example" {
+ name = "example-resources"
+ location = "West Europe"
+ }
+
+ resource "azurerm_postgresql_server" "example" {
+ name = "example-psqlserver"
+ location = azurerm_resource_group.example.location
+ resource_group_name = azurerm_resource_group.example.name
+
+ administrator_login = "psqladminun"
+ administrator_login_password = "H@Sh1CoR3!"
+
+ sku_name = "GP_Gen5_4"
+ version = "9.6"
+ storage_mb = 640000
+ }
+
+ resource "azurerm_postgresql_configuration" "example" {
+ name = "connection_throttling"
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_postgresql_server.example.name
+ value = "on"
+ }
+
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/docs.md
new file mode 100644
index 0000000..6331dad
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0021/docs.md
@@ -0,0 +1,13 @@
+
+Postgresql can generate logs for connection throttling to improve visibility for audit and configuration issue resolution.
+
+### Impact
+No log information to help diagnosing connection contention issues
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/postgresql/concepts-server-logs#configure-logging
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/Terraform.md
new file mode 100644
index 0000000..217393a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/Terraform.md
@@ -0,0 +1,21 @@
+
+Disable public access to database when not required
+
+```hcl
+ resource "azurerm_postgresql_server" "good_example" {
+ name = "bad_example"
+
+ public_network_access_enabled = false
+ ssl_enforcement_enabled = false
+ ssl_minimal_tls_version_enforced = "TLS1_2"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#public_network_access_enabled
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#public_network_access_enabled
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mariadb_server#public_network_access_enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/docs.md
new file mode 100644
index 0000000..06ae4f5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0022/docs.md
@@ -0,0 +1,10 @@
+
+Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.
+
+### Impact
+Publicly accessible database could lead to compromised data
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/Terraform.md
new file mode 100644
index 0000000..b429277
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/Terraform.md
@@ -0,0 +1,20 @@
+
+Enable email to subscription owners
+
+```hcl
+ resource "azurerm_mssql_server_security_alert_policy" "good_example" {
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_sql_server.example.name
+ state = "Enabled"
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ disabled_alerts = []
+
+ email_account_admins = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#email_account_admins
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/docs.md
new file mode 100644
index 0000000..e621fc2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0023/docs.md
@@ -0,0 +1,10 @@
+
+Subscription owners should be notified when there are security alerts. By ensuring the administrators of the account have been notified they can quickly assist in any required remediation
+
+### Impact
+Administrators and subscription owners may have a delayed response
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/Terraform.md
new file mode 100644
index 0000000..d9aa58a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/Terraform.md
@@ -0,0 +1,35 @@
+
+Enable checkpoint logging
+
+```hcl
+ resource "azurerm_resource_group" "example" {
+ name = "example-resources"
+ location = "West Europe"
+ }
+
+ resource "azurerm_postgresql_server" "example" {
+ name = "example-psqlserver"
+ location = azurerm_resource_group.example.location
+ resource_group_name = azurerm_resource_group.example.name
+
+ administrator_login = "psqladminun"
+ administrator_login_password = "H@Sh1CoR3!"
+
+ sku_name = "GP_Gen5_4"
+ version = "9.6"
+ storage_mb = 640000
+ }
+
+ resource "azurerm_postgresql_configuration" "example" {
+ name = "log_checkpoints"
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_postgresql_server.example.name
+ value = "on"
+ }
+
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/docs.md
new file mode 100644
index 0000000..5a66d6d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0024/docs.md
@@ -0,0 +1,13 @@
+
+Postgresql can generate logs for checkpoints to improve visibility for audit and configuration issue resolution.
+
+### Impact
+No error and query logs generated on checkpoint
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/postgresql/concepts-server-logs#configure-logging
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/Terraform.md
new file mode 100644
index 0000000..4693d39
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/Terraform.md
@@ -0,0 +1,26 @@
+
+Set retention periods of database auditing to greater than 90 days
+
+```hcl
+ resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
+ database_id = azurerm_mssql_database.example.id
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ storage_account_access_key_is_secondary = false
+ }
+
+ resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
+ database_id = azurerm_mssql_database.example.id
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ storage_account_access_key_is_secondary = false
+ retention_in_days = 90
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_database_extended_auditing_policy
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#retention_in_days
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/docs.md
new file mode 100644
index 0000000..86e473b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0025/docs.md
@@ -0,0 +1,15 @@
+
+When Auditing is configured for a SQL database, if the retention period is not set, the retention will be unlimited.
+
+If the retention period is to be explicitly set, it should be set for no less than 90 days.
+
+### Impact
+Short logging retention could result in missing valuable historical information
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/Terraform.md
new file mode 100644
index 0000000..86ba9c2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/Terraform.md
@@ -0,0 +1,31 @@
+
+Use the most modern TLS policies available
+
+```hcl
+ resource "azurerm_mssql_server" "good_example" {
+ name = "mssqlserver"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ version = "12.0"
+ administrator_login = "missadministrator"
+ administrator_login_password = "thisIsKat11"
+ minimum_tls_version = "1.2"
+ }
+
+ resource "azurerm_postgresql_server" "good_example" {
+ name = "bad_example"
+
+ public_network_access_enabled = true
+ ssl_enforcement_enabled = false
+ ssl_minimal_tls_version_enforced = "TLS1_2"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#minimum_tls_version
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#ssl_minimal_tls_version_enforced
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#ssl_minimal_tls_version_enforced
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/docs.md
new file mode 100644
index 0000000..1cbe228
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0026/docs.md
@@ -0,0 +1,10 @@
+
+You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
+
+### Impact
+Outdated TLS policies increase exposure to known issues
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/Terraform.md
new file mode 100644
index 0000000..81b5309
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/Terraform.md
@@ -0,0 +1,25 @@
+
+Enable auditing on Azure SQL databases
+
+```hcl
+ resource "azurerm_sql_server" "good_example" {
+ name = "mssqlserver"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ version = "12.0"
+ administrator_login = "mradministrator"
+ administrator_login_password = "tfsecRocks"
+
+ extended_auditing_policy {
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ storage_account_access_key_is_secondary = true
+ retention_in_days = 6
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sql_server#extended_auditing_policy
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/docs.md
new file mode 100644
index 0000000..09d302c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0027/docs.md
@@ -0,0 +1,13 @@
+
+Auditing helps you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations.
+
+### Impact
+Auditing provides valuable information about access and usage
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/Terraform.md
new file mode 100644
index 0000000..0f07baa
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/Terraform.md
@@ -0,0 +1,19 @@
+
+Use all provided threat alerts
+
+```hcl
+ resource "azurerm_mssql_server_security_alert_policy" "good_example" {
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_sql_server.example.name
+ state = "Enabled"
+ storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint
+ storage_account_access_key = azurerm_storage_account.example.primary_access_key
+ disabled_alerts = []
+ retention_days = 20
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#disabled_alerts
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/docs.md
new file mode 100644
index 0000000..895ef12
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0028/docs.md
@@ -0,0 +1,10 @@
+
+SQL Server can alert for security issues including SQL Injection, vulnerabilities, access anomalies and data exfiltration. Ensure none of these are disabled to benefit from the best protection
+
+### Impact
+Disabling threat alerts means you are not getting the full benefit of server security protection
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/Terraform.md
new file mode 100644
index 0000000..11e3170
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/Terraform.md
@@ -0,0 +1,17 @@
+
+Don't use wide ip ranges for the sql firewall
+
+```hcl
+ resource "azurerm_sql_firewall_rule" "good_example" {
+ name = "good_rule"
+ resource_group_name = azurerm_resource_group.example.name
+ server_name = azurerm_sql_server.example.name
+ start_ip_address = "0.0.0.0"
+ end_ip_address = "0.0.0.0"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sql_firewall_rule#end_ip_address
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/docs.md
new file mode 100644
index 0000000..0bc32bc
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/database/AVD-AZU-0029/docs.md
@@ -0,0 +1,13 @@
+
+Azure services can be allowed access through the firewall using a start and end IP address of 0.0.0.0. No other end ip address should be combined with a start of 0.0.0.0
+
+### Impact
+Publicly accessible databases could lead to compromised data
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/rest/api/sql/2021-02-01-preview/firewall-rules/create-or-update
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md
new file mode 100644
index 0000000..f249dca
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md
@@ -0,0 +1,16 @@
+
+Set public access to disabled for Data Factory
+
+```hcl
+ resource "azurerm_data_factory" "good_example" {
+ name = "example"
+ location = azurerm_resource_group.example.location
+ resource_group_name = azurerm_resource_group.example.name
+ public_network_enabled = false
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/data_factory#public_network_enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/docs.md
new file mode 100644
index 0000000..aa0aae4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/datafactory/AVD-AZU-0035/docs.md
@@ -0,0 +1,15 @@
+
+Data Factory has public access set to true by default.
+
+Disabling public network access is applicable only to the self-hosted integration runtime, not to Azure Integration Runtime and SQL Server Integration Services (SSIS) Integration Runtime.
+
+### Impact
+Data factory is publicly accessible
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/data-factory/data-movement-security-considerations#hybrid-scenarios
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md
new file mode 100644
index 0000000..d25432c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md
@@ -0,0 +1,12 @@
+
+Enable encryption of data lake storage
+
+```hcl
+ resource "azurerm_data_lake_store" "good_example" {
+ encryption_state = "Enabled"
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/data_lake_store
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/docs.md
new file mode 100644
index 0000000..32f5ea7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/datalake/AVD-AZU-0036/docs.md
@@ -0,0 +1,13 @@
+
+Datalake storage encryption defaults to Enabled, it shouldn't be overridden to Disabled.
+
+### Impact
+Data could be read if compromised
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-security-overview
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md
new file mode 100644
index 0000000..eadbee7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md
@@ -0,0 +1,22 @@
+
+Set a network ACL for the key vault
+
+```hcl
+ resource "azurerm_key_vault" "good_example" {
+ name = "examplekeyvault"
+ location = azurerm_resource_group.good_example.location
+ enabled_for_disk_encryption = true
+ soft_delete_retention_days = 7
+ purge_protection_enabled = false
+
+ network_acls {
+ bypass = "AzureServices"
+ default_action = "Deny"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/docs.md
new file mode 100644
index 0000000..03091f0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0013/docs.md
@@ -0,0 +1,15 @@
+
+Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault.
+
+The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.
+
+### Impact
+Without a network ACL the key vault is freely accessible
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/key-vault/general/network-security
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md
new file mode 100644
index 0000000..e4cda44
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md
@@ -0,0 +1,26 @@
+
+Set an expiration date on the vault key
+
+```hcl
+ resource "azurerm_key_vault_key" "good_example" {
+ name = "generated-certificate"
+ key_vault_id = azurerm_key_vault.example.id
+ key_type = "RSA"
+ key_size = 2048
+ expiration_date = "1982-12-31T00:00:00Z"
+
+ key_opts = [
+ "decrypt",
+ "encrypt",
+ "sign",
+ "unwrapKey",
+ "verify",
+ "wrapKey",
+ ]
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/docs.md
new file mode 100644
index 0000000..d2e5b27
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0014/docs.md
@@ -0,0 +1,15 @@
+
+Expiration Date is an optional Key Vault Key behavior and is not set by default.
+
+Set when the resource will be become inactive.
+
+### Impact
+Long life keys increase the attack surface when compromised
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md
new file mode 100644
index 0000000..b8896eb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md
@@ -0,0 +1,16 @@
+
+Provide content type for secrets to aid interpretation on retrieval
+
+```hcl
+ resource "azurerm_key_vault_secret" "good_example" {
+ name = "secret-sauce"
+ value = "szechuan"
+ key_vault_id = azurerm_key_vault.example.id
+ content_type = "password"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/docs.md
new file mode 100644
index 0000000..ad64390
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0015/docs.md
@@ -0,0 +1,15 @@
+
+Content Type is an optional Key Vault Secret behavior and is not enabled by default.
+
+Clients may specify the content type of a secret to assist in interpreting the secret data when it's retrieved. The maximum length of this field is 255 characters. There are no pre-defined values. The suggested usage is as a hint for interpreting the secret data.
+
+### Impact
+The secret's type is unclear without a content type
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md
new file mode 100644
index 0000000..3ab531c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md
@@ -0,0 +1,17 @@
+
+Enable purge protection for key vaults
+
+```hcl
+ resource "azurerm_key_vault" "good_example" {
+ name = "examplekeyvault"
+ location = azurerm_resource_group.good_example.location
+ enabled_for_disk_encryption = true
+ soft_delete_retention_days = 7
+ purge_protection_enabled = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/docs.md
new file mode 100644
index 0000000..27eb6ad
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0016/docs.md
@@ -0,0 +1,15 @@
+
+Purge protection is an optional Key Vault behavior and is not enabled by default.
+
+Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI or PowerShell.
+
+### Impact
+Keys could be purged from the vault without protection
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md
new file mode 100644
index 0000000..e5b1f8e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md
@@ -0,0 +1,38 @@
+
+Set an expiry for secrets
+
+```hcl
+ resource "azurerm_key_vault_secret" "good_example" {
+ name = "secret-sauce"
+ value = "szechuan"
+ key_vault_id = azurerm_key_vault.example.id
+ expiration_date = "1982-12-31T00:00:00Z"
+ }
+
+```
+```hcl
+resource "azuread_application" "myapp" {
+ display_name = "MyAzureAD App"
+
+ group_membership_claims = ["ApplicationGroup"]
+ prevent_duplicate_names = true
+
+}
+
+resource "azuread_application_password" "myapp" {
+ application_object_id = azuread_application.myapp.object_id
+}
+
+resource "azurerm_key_vault_secret" "myapp_pass" {
+ name = "myapp-oauth"
+ value = azuread_application_password.myapp.value
+ key_vault_id = azurerm_key_vault.cluster_key_vault.id
+ expiration_date = azuread_application_password.myapp.end_date
+ content_type = "Password"
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/docs.md
new file mode 100644
index 0000000..a85b4c2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/keyvault/AVD-AZU-0017/docs.md
@@ -0,0 +1,15 @@
+
+Expiration Date is an optional Key Vault Secret behavior and is not set by default.
+
+Set when the resource will be become inactive.
+
+### Impact
+Long life secrets increase the opportunity for compromise
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md
new file mode 100644
index 0000000..ed69ea0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md
@@ -0,0 +1,18 @@
+
+Set a retention period that will allow for delayed investigation
+
+```hcl
+ resource "azurerm_monitor_log_profile" "good_example" {
+ name = "good_example"
+
+ retention_policy {
+ enabled = true
+ days = 365
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#retention_policy
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/docs.md
new file mode 100644
index 0000000..2e4c39a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0031/docs.md
@@ -0,0 +1,13 @@
+
+The average time to detect a breach is up to 210 days, to ensure that all the information required for an effective investigation is available, the retention period should allow for delayed starts to investigating.
+
+### Impact
+Short life activity logs can lead to missing records when investigating a breach
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md
new file mode 100644
index 0000000..b7e1094
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md
@@ -0,0 +1,92 @@
+
+Enable capture for all locations
+
+```hcl
+ resource "azurerm_monitor_log_profile" "good_example" {
+ name = "bad_example"
+
+ categories = []
+
+ locations = [
+ "eastus",
+ "eastus2",
+ "southcentralus",
+ "westus2",
+ "westus3",
+ "australiaeast",
+ "southeastasia",
+ "northeurope",
+ "swedencentral",
+ "uksouth",
+ "westeurope",
+ "centralus",
+ "northcentralus",
+ "westus",
+ "southafricanorth",
+ "centralindia",
+ "eastasia",
+ "japaneast",
+ "jioindiawest",
+ "koreacentral",
+ "canadacentral",
+ "francecentral",
+ "germanywestcentral",
+ "norwayeast",
+ "switzerlandnorth",
+ "uaenorth",
+ "brazilsouth",
+ "centralusstage",
+ "eastusstage",
+ "eastus2stage",
+ "northcentralusstage",
+ "southcentralusstage",
+ "westusstage",
+ "westus2stage",
+ "asia",
+ "asiapacific",
+ "australia",
+ "brazil",
+ "canada",
+ "europe",
+ "global",
+ "india",
+ "japan",
+ "uk",
+ "unitedstates",
+ "eastasiastage",
+ "southeastasiastage",
+ "centraluseuap",
+ "eastus2euap",
+ "westcentralus",
+ "southafricawest",
+ "australiacentral",
+ "australiacentral2",
+ "australiasoutheast",
+ "japanwest",
+ "jioindiacentral",
+ "koreasouth",
+ "southindia",
+ "westindia",
+ "canadaeast",
+ "francesouth",
+ "germanynorth",
+ "norwaywest",
+ "swedensouth",
+ "switzerlandwest",
+ "ukwest",
+ "uaecentral",
+ "brazilsoutheast",
+ ]
+
+ retention_policy {
+ enabled = true
+ days = 7
+ }
+ }
+
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#locations
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/docs.md
new file mode 100644
index 0000000..ec736a9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0032/docs.md
@@ -0,0 +1,13 @@
+
+Log profiles should capture all regions to ensure that all events are logged
+
+### Impact
+Activity may be occurring in locations that aren't being monitored
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest#az_monitor_log_profiles_create-required-parameters
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md
new file mode 100644
index 0000000..be85029
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md
@@ -0,0 +1,24 @@
+
+Configure log profile to capture all activities
+
+```hcl
+ resource "azurerm_monitor_log_profile" "good_example" {
+ name = "good_example"
+
+ categories = [
+ "Action",
+ "Delete",
+ "Write",
+ ]
+
+ retention_policy {
+ enabled = true
+ days = 365
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#categories
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/docs.md
new file mode 100644
index 0000000..1619682
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/monitor/AVD-AZU-0033/docs.md
@@ -0,0 +1,15 @@
+
+Log profiles should capture all categories to ensure that all events are logged
+
+### Impact
+Log profile must capture all activity to be able to ensure that all relevant information possible is available for an investigation
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
+
+- https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest#az_monitor_log_profiles_create-required-parameters
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/Terraform.md
new file mode 100644
index 0000000..9d0018d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/Terraform.md
@@ -0,0 +1,24 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "azurerm_network_security_rule" "good_example" {
+ direction = "Inbound"
+ destination_address_prefix = "10.0.0.0/16"
+ access = "Allow"
+ }
+```
+```hcl
+resource "azurerm_network_security_rule" "allow_lb_prober" {
+ direction = "Inbound"
+ access = "Allow"
+ protocol = "Tcp" # Probes are always TCP
+ source_port_range = "*"
+ destination_port_ranges = "443"
+ source_address_prefix = "168.63.129.16" // single public IP (Azure well known)
+}
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/docs.md
new file mode 100644
index 0000000..4137611
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0047/docs.md
@@ -0,0 +1,15 @@
+
+Network security rules should not use very broad subnets.
+
+Where possible, segments should be broken into smaller subnets.
+
+### Impact
+The port is exposed for ingress from the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/Terraform.md
new file mode 100644
index 0000000..0012503
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/Terraform.md
@@ -0,0 +1,35 @@
+
+Block RDP port from internet
+
+```hcl
+ resource "azurerm_network_security_rule" "good_example" {
+ name = "good_example_security_rule"
+ direction = "Inbound"
+ access = "Allow"
+ protocol = "TCP"
+ source_port_range = "*"
+ destination_port_ranges = ["3389"]
+ source_address_prefix = "4.53.160.75"
+ destination_address_prefix = "*"
+ }
+
+ resource "azurerm_network_security_group" "example" {
+ name = "tf-appsecuritygroup"
+ location = azurerm_resource_group.example.location
+ resource_group_name = azurerm_resource_group.example.name
+
+ security_rule {
+ source_port_range = "any"
+ destination_port_ranges = ["3389"]
+ source_address_prefix = "4.53.160.75"
+ destination_address_prefix = "*"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/network_security_group#security_rule
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule#source_port_ranges
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/docs.md
new file mode 100644
index 0000000..eef047c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0048/docs.md
@@ -0,0 +1,15 @@
+
+RDP access can be configured on either the network security group or in the network security group rule.
+
+RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any). Consider using the Azure Bastion Service.
+
+### Impact
+Anyone from the internet can potentially RDP onto an instance
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/Terraform.md
new file mode 100644
index 0000000..f8b5db6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/Terraform.md
@@ -0,0 +1,23 @@
+
+Ensure flow log retention is turned on with an expiry of >90 days
+
+```hcl
+resource "azurerm_network_watcher_flow_log" "good_watcher" {
+ network_watcher_name = "good_watcher"
+ resource_group_name = "resource-group"
+
+ network_security_group_id = azurerm_network_security_group.test.id
+ storage_account_id = azurerm_storage_account.test.id
+ enabled = true
+
+ retention_policy {
+ enabled = true
+ days = 90
+ }
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_watcher_flow_log#retention_policy
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/docs.md
new file mode 100644
index 0000000..d5e28c3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0049/docs.md
@@ -0,0 +1,16 @@
+
+Flow logs are the source of truth for all network activity in your cloud environment.
+To enable analysis in security event that was detected late, you need to have the logs available.
+
+Setting an retention policy will help ensure as much information is available for review.
+
+### Impact
+Not enabling retention or having short expiry on flow logs could lead to compromise being undetected limiting time for analysis
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/Terraform.md
new file mode 100644
index 0000000..65c256a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/Terraform.md
@@ -0,0 +1,22 @@
+
+Block port 22 access from the internet
+
+```hcl
+ resource "azurerm_network_security_rule" "good_example" {
+ name = "good_example_security_rule"
+ direction = "Inbound"
+ access = "Allow"
+ protocol = "TCP"
+ source_port_range = "*"
+ destination_port_range = "22"
+ source_address_prefix = "82.102.23.23"
+ destination_address_prefix = "*"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/network_security_group#security_rule
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule#source_port_ranges
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/docs.md
new file mode 100644
index 0000000..e42590c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0050/docs.md
@@ -0,0 +1,12 @@
+
+SSH access can be configured on either the network security group or in the network security group rule.
+
+SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any)
+
+### Impact
+Its dangerous to allow SSH access from the internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/Terraform.md
new file mode 100644
index 0000000..1781c9c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/Terraform.md
@@ -0,0 +1,14 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "azurerm_network_security_rule" "good_example" {
+ direction = "Outbound"
+ destination_address_prefix = "10.0.0.0/16"
+ access = "Allow"
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/docs.md
new file mode 100644
index 0000000..b5834eb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/network/AVD-AZU-0051/docs.md
@@ -0,0 +1,15 @@
+
+Network security rules should not use very broad subnets.
+
+Where possible, segments should be broken into smaller subnets.
+
+### Impact
+The port is exposed for egress to the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md
new file mode 100644
index 0000000..ddd8c46
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md
@@ -0,0 +1,17 @@
+
+ Set alert notifications to be on
+
+```hcl
+ resource "azurerm_security_center_contact" "good_example" {
+ email = "good_example@example.com"
+ phone = "+1-555-555-5555"
+
+ alert_notifications = true
+ alerts_to_admins = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_contact#alert_notifications
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/docs.md
new file mode 100644
index 0000000..b1a5bf9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0044/docs.md
@@ -0,0 +1,14 @@
+
+It is recommended that at least one valid contact is configured for the security center.
+Microsoft will notify the security contact directly in the event of a security incident using email and require alerting to be turned on.
+
+### Impact
+The ability to react to high severity notifications could be delayed
+
+
+{{ remediationActions }}
+
+### Links
+- https://azure.microsoft.com/en-us/services/security-center/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md
new file mode 100644
index 0000000..4db565e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md
@@ -0,0 +1,14 @@
+
+Enable standard subscription tier to benefit from Azure Defender
+
+```hcl
+ resource "azurerm_security_center_subscription_pricing" "good_example" {
+ tier = "Standard"
+ resource_type = "VirtualMachines"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_subscription_pricing#tier
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/docs.md
new file mode 100644
index 0000000..62c1ab4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0045/docs.md
@@ -0,0 +1,15 @@
+
+To benefit from Azure Defender you should use the Standard subscription tier.
+
+ Enabling Azure Defender extends the capabilities of the free mode to workloads running in private and other public clouds, providing unified security management and threat protection across your hybrid cloud workloads.
+
+### Impact
+Using free subscription does not enable Azure Defender for the resource type
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md
new file mode 100644
index 0000000..af31d46
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md
@@ -0,0 +1,17 @@
+
+Set a telephone number for security center contact
+
+```hcl
+ resource "azurerm_security_center_contact" "good_example" {
+ email = "good_contact@example.com"
+ phone = "+1-555-555-5555"
+
+ alert_notifications = true
+ alerts_to_admins = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_contact#phone
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/docs.md
new file mode 100644
index 0000000..1209555
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/securitycenter/AVD-AZU-0046/docs.md
@@ -0,0 +1,14 @@
+
+It is recommended that at least one valid contact is configured for the security center.
+Microsoft will notify the security contact directly in the event of a security incident and will look to use a telephone number in cases where a prompt response is required.
+
+### Impact
+Without a telephone number set, Azure support can't contact
+
+
+{{ remediationActions }}
+
+### Links
+- https://azure.microsoft.com/en-us/services/security-center/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md
new file mode 100644
index 0000000..57a5030
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md
@@ -0,0 +1,14 @@
+
+Disable public access to storage containers
+
+```hcl
+ resource "azurerm_storage_container" "good_example" {
+ name = "terraform-container-storage"
+ container_access_type = "private"
+ }
+
+```
+
+#### Remediation Links
+ - https://www.terraform.io/docs/providers/azure/r/storage_container.html#properties
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/docs.md
new file mode 100644
index 0000000..0c33370
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0007/docs.md
@@ -0,0 +1,15 @@
+
+Storage container public access should be off. It can be configured for blobs only, containers and blobs or off entirely. The default is off, with no public access.
+
+Explicitly overriding publicAccess to anything other than off should be avoided.
+
+### Impact
+Data in the storage container could be exposed publicly
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#set-the-public-access-level-for-a-container
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md
new file mode 100644
index 0000000..e94b9e7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md
@@ -0,0 +1,18 @@
+
+Only allow secure connection for transferring data into storage accounts
+
+```hcl
+ resource "azurerm_storage_account" "good_example" {
+ name = "storageaccountname"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ account_tier = "Standard"
+ account_replication_type = "GRS"
+ enable_https_traffic_only = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/docs.md
new file mode 100644
index 0000000..bf5b179
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0008/docs.md
@@ -0,0 +1,17 @@
+
+You can configure your storage account to accept requests from secure connections only by setting the Secure transfer required property for the storage account.
+
+When you require secure transfer, any requests originating from an insecure connection are rejected.
+
+Microsoft recommends that you always require secure transfer for all of your storage accounts.
+
+### Impact
+Insecure transfer of data into secure accounts could be read if intercepted
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md
new file mode 100644
index 0000000..a0170a9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md
@@ -0,0 +1,26 @@
+
+Enable logging for Queue Services
+
+```hcl
+ resource "azurerm_storage_account" "good_example" {
+ name = "example"
+ resource_group_name = data.azurerm_resource_group.example.name
+ location = data.azurerm_resource_group.example.location
+ account_tier = "Standard"
+ account_replication_type = "GRS"
+ queue_properties {
+ logging {
+ delete = true
+ read = true
+ write = true
+ version = "1.0"
+ retention_policy_days = 10
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/docs.md
new file mode 100644
index 0000000..605f587
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0009/docs.md
@@ -0,0 +1,17 @@
+
+Storage Analytics logs detailed information about successful and failed requests to a storage service.
+
+This information can be used to monitor individual requests and to diagnose issues with a storage service.
+
+Requests are logged on a best-effort basis.
+
+### Impact
+Logging provides valuable information about access and usage
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md
new file mode 100644
index 0000000..cf440d4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md
@@ -0,0 +1,41 @@
+
+Allow Trusted Microsoft Services to bypass
+
+```hcl
+ resource "azurerm_storage_account" "good_example" {
+ name = "storageaccountname"
+ resource_group_name = azurerm_resource_group.example.name
+
+ location = azurerm_resource_group.example.location
+ account_tier = "Standard"
+ account_replication_type = "LRS"
+
+ network_rules {
+ default_action = "Deny"
+ ip_rules = ["100.0.0.1"]
+ virtual_network_subnet_ids = [azurerm_subnet.example.id]
+ bypass = ["Metrics", "AzureServices"]
+ }
+
+ tags = {
+ environment = "staging"
+ }
+ }
+
+ resource "azurerm_storage_account_network_rules" "test" {
+ resource_group_name = azurerm_resource_group.test.name
+ storage_account_name = azurerm_storage_account.test.name
+
+ default_action = "Allow"
+ ip_rules = ["127.0.0.1"]
+ virtual_network_subnet_ids = [azurerm_subnet.test.id]
+ bypass = ["Metrics", "AzureServices"]
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass
+
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/docs.md
new file mode 100644
index 0000000..f63f1b7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0010/docs.md
@@ -0,0 +1,15 @@
+
+Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules.
+
+To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules
+
+### Impact
+Trusted Microsoft Services won't be able to access storage account unless rules set to allow
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md
new file mode 100644
index 0000000..5f47809
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md
@@ -0,0 +1,16 @@
+
+Use a more recent TLS/SSL policy for the load balancer
+
+```hcl
+ resource "azurerm_storage_account" "good_example" {
+ name = "storageaccountname"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ min_tls_version = "TLS1_2"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/docs.md
new file mode 100644
index 0000000..c4985a2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0011/docs.md
@@ -0,0 +1,17 @@
+
+Azure Storage currently supports three versions of the TLS protocol: 1.0, 1.1, and 1.2.
+
+Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0 and TLS 1.1 are still supported for backward compatibility.
+
+This check will warn if the minimum TLS is not set to TLS1_2.
+
+### Impact
+The TLS version being outdated and has known vulnerabilities
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md
new file mode 100644
index 0000000..b6ed570
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md
@@ -0,0 +1,17 @@
+
+Set network rules to deny
+
+```hcl
+ resource "azurerm_storage_account_network_rules" "good_example" {
+
+ default_action = "Deny"
+ ip_rules = ["127.0.0.1"]
+ virtual_network_subnet_ids = [azurerm_subnet.test.id]
+ bypass = ["Metrics"]
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/docs.md
new file mode 100644
index 0000000..9b76847
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/storage/AVD-AZU-0012/docs.md
@@ -0,0 +1,15 @@
+
+The default_action for network rules should come into effect when no other rules are matched.
+
+The default action should be set to Deny.
+
+### Impact
+Network rules that allow could cause data to be exposed publicly
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/firewall/rule-processing
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md b/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md
new file mode 100644
index 0000000..ca7bcf0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md
@@ -0,0 +1,28 @@
+
+Set manage virtual network to enabled
+
+```hcl
+ resource "azurerm_synapse_workspace" "good_example" {
+ name = "example"
+ resource_group_name = azurerm_resource_group.example.name
+ location = azurerm_resource_group.example.location
+ storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
+ sql_administrator_login = "sqladminuser"
+ sql_administrator_login_password = "H@Sh1CoR3!"
+ managed_virtual_network_enabled = true
+ aad_admin {
+ login = "AzureAD Admin"
+ object_id = "00000000-0000-0000-0000-000000000000"
+ tenant_id = "00000000-0000-0000-0000-000000000000"
+ }
+
+ tags = {
+ Env = "production"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/synapse_workspace#managed_virtual_network_enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/docs.md b/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/docs.md
new file mode 100644
index 0000000..9e31b5d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/azure/synapse/AVD-AZU-0034/docs.md
@@ -0,0 +1,18 @@
+
+Synapse Workspace does not have managed virtual network enabled by default.
+
+When you create your Azure Synapse workspace, you can choose to associate it to a Microsoft Azure Virtual Network. The Virtual Network associated with your workspace is managed by Azure Synapse. This Virtual Network is called a Managed workspace Virtual Network.
+Managed private endpoints are private endpoints created in a Managed Virtual Network associated with your Azure Synapse workspace. Managed private endpoints establish a private link to Azure resources. You can only use private links in a workspace that has a Managed workspace Virtual Network.
+
+### Impact
+Your Synapse workspace is not using the private endpoints
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-private-endpoints
+
+- https://docs.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md
new file mode 100644
index 0000000..5cec9f6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md
@@ -0,0 +1,31 @@
+
+Don't use sensitive data in the user data section
+
+```hcl
+ resource "cloudstack_instance" "web" {
+ name = "server-1"
+ service_offering = "small"
+ network_id = "6eb22f91-7454-4107-89f4-36afcdf33021"
+ template = "CentOS 6.5"
+ zone = "zone-1"
+ user_data = <This page is empty.
" + content_type = "text/html" + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/spaces_bucket#acl + + - https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/spaces_bucket_object#acl + diff --git a/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0006/docs.md new file mode 100644 index 0000000..581bf74 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0006/docs.md @@ -0,0 +1,13 @@ + +Space bucket and bucket object permissions should be set to deny public access unless explicitly required. + +### Impact +The contents of the space can be accessed publicly + + +{{ remediationActions }} + +### Links +- https://docs.digitalocean.com/reference/api/spaces-api/#access-control-lists-acls + + diff --git a/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/Terraform.md b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/Terraform.md new file mode 100644 index 0000000..dbacca5 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/Terraform.md @@ -0,0 +1,18 @@ + +Enable versioning to protect against accidental or malicious removal or modification + +```hcl + resource "digitalocean_spaces_bucket" "good_example" { + name = "foobar" + region = "nyc3" + + versioning { + enabled = true + } + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/spaces_bucket#versioning + diff --git a/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/docs.md new file mode 100644 index 0000000..ba0791c --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0007/docs.md @@ -0,0 +1,13 @@ + +Versioning is a means of keeping multiple variants of an object in the same bucket. You can use the Spaces (S3) Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets. With versioning you can recover more easily from both unintended user actions and application failures. + +### Impact +Deleted or modified data would not be recoverable + + +{{ remediationActions }} + +### Links +- https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html + + diff --git a/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/Terraform.md b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/Terraform.md new file mode 100644 index 0000000..28eee9d --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/Terraform.md @@ -0,0 +1,14 @@ + +Don't use force destroy on bucket configuration + +```hcl + resource "digitalocean_spaces_bucket" "good_example" { + name = "foobar" + region = "nyc3" + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/spaces_bucket#force_destroy + diff --git a/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/docs.md new file mode 100644 index 0000000..d999409 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/digitalocean/spaces/AVD-DIG-0009/docs.md @@ -0,0 +1,10 @@ + +Enabling force destroy on a Spaces bucket means that the bucket can be deleted without the additional check that it is empty. This risks important data being accidentally deleted by a bucket removal process. + +### Impact +Accidental deletion of bucket objects + + +{{ remediationActions }} + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0001/docs.md new file mode 100644 index 0000000..066bf02 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0001/docs.md @@ -0,0 +1,10 @@ + +When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated. + +### Impact + + + +{{ remediationActions }} + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0002/docs.md new file mode 100644 index 0000000..42d2f5a --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0002/docs.md @@ -0,0 +1,13 @@ + +Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/ + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0004/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0004/docs.md new file mode 100644 index 0000000..2453639 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0004/docs.md @@ -0,0 +1,10 @@ + +Exposing port 22 might allow users to SSH into the container. + +### Impact + + + +{{ remediationActions }} + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0005/docs.md new file mode 100644 index 0000000..1accae9 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0005/docs.md @@ -0,0 +1,13 @@ + +You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#add + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0006/docs.md new file mode 100644 index 0000000..b6e00eb --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0006/docs.md @@ -0,0 +1,13 @@ + +COPY '--from' should not mention the current FROM alias, since it is impossible to copy from itself. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/multistage-build/ + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0007/docs.md new file mode 100644 index 0000000..6121fe8 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0007/docs.md @@ -0,0 +1,13 @@ + +There can only be one ENTRYPOINT instruction in a Dockerfile. Only the last ENTRYPOINT instruction in the Dockerfile will have an effect. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#entrypoint + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0008/docs.md new file mode 100644 index 0000000..bc133d6 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0008/docs.md @@ -0,0 +1,13 @@ + +UNIX ports outside the range 0-65535 are exposed. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#expose + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0009/docs.md new file mode 100644 index 0000000..9d1d23e --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0009/docs.md @@ -0,0 +1,13 @@ + +For clarity and reliability, you should always use absolute paths for your WORKDIR. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#workdir + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0010/docs.md new file mode 100644 index 0000000..82386d6 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0010/docs.md @@ -0,0 +1,13 @@ + +Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#run + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0011/docs.md new file mode 100644 index 0000000..017ef5d --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0011/docs.md @@ -0,0 +1,13 @@ + +When a COPY command has more than two arguments, the last one should end with a slash. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#copy + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0012/docs.md new file mode 100644 index 0000000..e025aff --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0012/docs.md @@ -0,0 +1,13 @@ + +Different FROMs can't have the same alias defined. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/multistage-build/ + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0013/docs.md new file mode 100644 index 0000000..dd4522e --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0013/docs.md @@ -0,0 +1,13 @@ + +Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#workdir + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0014/docs.md new file mode 100644 index 0000000..a20d8e9 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0014/docs.md @@ -0,0 +1,13 @@ + +Avoid using both 'wget' and 'curl' since these tools have the same effect. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0015/docs.md new file mode 100644 index 0000000..4b0e97c --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0015/docs.md @@ -0,0 +1,13 @@ + +You should use 'yum clean all' after using a 'yum install' command to clean package cached data and reduce image size. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0016/docs.md new file mode 100644 index 0000000..1523a1d --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0016/docs.md @@ -0,0 +1,13 @@ + +There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.docker.com/engine/reference/builder/#cmd + + diff --git a/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0017/docs.md new file mode 100644 index 0000000..383a854 --- /dev/null +++ b/cmd/trivy-policies-generator/avd_docs/dockerfile/general/AVD-DS-0017/docs.md @@ -0,0 +1,13 @@ + +The instruction 'RUNrequire_signed_commits attribute to 'true'.
+
+### Impact
+Commits may not be verified and signed as coming from a trusted developer
+
+
+{{ remediationActions }}
+
+### Links
+- https://registry.terraform.io/providers/integrations/github/latest/docs/resources/branch_protection#require_signed_commits
+
+- https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
+
+- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches#require-signed-commits
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/Terraform.md
new file mode 100644
index 0000000..57d8474
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/Terraform.md
@@ -0,0 +1,21 @@
+
+Make sensitive or commercially important repositories private
+
+```hcl
+ resource "github_repository" "good_example" {
+ name = "example"
+ description = "My awesome codebase"
+
+ visibility = "private"
+
+ template {
+ owner = "github"
+ repository = "terraform-module-template"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository
+
diff --git a/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/docs.md
new file mode 100644
index 0000000..b6ce668
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0001/docs.md
@@ -0,0 +1,17 @@
+
+Github repository should be set to be private.
+
+You can do this by either setting private attribute to 'true' or visibility attribute to 'internal' or 'private'.
+
+### Impact
+Anyone can read the contents of the GitHub repository and leak IP
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-repository-visibility
+
+- https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-repository-visibility#about-internal-repositories
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/Terraform.md b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/Terraform.md
new file mode 100644
index 0000000..5e179ad
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable vulnerability alerts
+
+```hcl
+ resource "github_repository" "good_example" {
+ name = "example"
+ description = "My awesome codebase"
+
+ vulnerability_alerts = true
+
+ template {
+ owner = "github"
+ repository = "terraform-module-template"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository
+
diff --git a/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/docs.md
new file mode 100644
index 0000000..7fb4db4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/github/repositories/AVD-GIT-0003/docs.md
@@ -0,0 +1,15 @@
+
+GitHub repository should be set to use vulnerability alerts.
+
+You can do this by setting the vulnerability_alerts attribute to 'true'.
+
+### Impact
+Known vulnerabilities may not be discovered
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/Terraform.md
new file mode 100644
index 0000000..587723a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/Terraform.md
@@ -0,0 +1,35 @@
+
+Configure access permissions with higher granularity
+
+```hcl
+ resource "google_bigquery_dataset" "good_example" {
+ dataset_id = "example_dataset"
+ friendly_name = "test"
+ description = "This is a test description"
+ location = "EU"
+ default_table_expiration_ms = 3600000
+
+ labels = {
+ env = "default"
+ }
+
+ access {
+ role = "OWNER"
+ user_by_email = google_service_account.bqowner.email
+ }
+
+ access {
+ role = "READER"
+ domain = "hashicorp.com"
+ }
+ }
+
+ resource "google_service_account" "bqowner" {
+ account_id = "bqowner"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/bigquery_dataset#special_group
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/docs.md b/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/docs.md
new file mode 100644
index 0000000..eb5d517
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/bigquery/AVD-GCP-0046/docs.md
@@ -0,0 +1,10 @@
+
+Using 'allAuthenticatedUsers' provides any GCP user - even those outside of your organisation - access to your BigQuery dataset.
+
+### Impact
+Exposure of sensitive data to the public iniernet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/Terraform.md
new file mode 100644
index 0000000..39a4cee
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/Terraform.md
@@ -0,0 +1,46 @@
+
+Set a more restrictive cidr range
+
+```hcl
+resource "google_compute_firewall" "good_example" {
+ source_ranges = ["1.2.3.4/32"]
+ allow {
+ protocol = "icmp"
+ }
+}
+```
+```hcl
+resource "google_compute_firewall" "allow-vms-to-some-machine" {
+ name = "allow-vms-to-some-machine"
+ network = local.network
+ priority = 1300
+ direction = "INGRESS"
+ allow {
+ protocol = "tcp"
+ ports = ["8081"]
+ }
+ source_tags = ["vms"]
+ target_tags = ["some-machine"]
+}
+```
+```hcl
+resource "google_compute_firewall" "test" {
+ name = "gmp-validating-webhook-fw"
+ network = google_compute_network.my_vpc_name.self_link
+
+ allow {
+ protocol = "tcp"
+ ports = ["8443"]
+ }
+
+ target_tags = [ "k8s-node-pool" ]
+ source_ranges = [google_container_cluster.my_cluster_name.private_cluster_config[0].master_ipv4_cidr_block]
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall#source_ranges
+
+ - https://www.terraform.io/docs/providers/google/r/compute_firewall.html
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/docs.md
new file mode 100644
index 0000000..5c1fdab
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0027/docs.md
@@ -0,0 +1,15 @@
+
+Network security rules should not use very broad subnets.
+
+Where possible, segments should be broken into smaller subnets and avoid using the /0 subnet.
+
+### Impact
+The port is exposed for ingress from the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/vpc/docs/using-firewalls
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/Terraform.md
new file mode 100644
index 0000000..20b5774
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/Terraform.md
@@ -0,0 +1,29 @@
+
+Enable VPC flow logs
+
+```hcl
+resource "google_compute_subnetwork" "good_example" {
+ name = "test-subnetwork"
+ ip_cidr_range = "10.2.0.0/16"
+ region = "us-central1"
+ network = google_compute_network.custom-test.id
+ secondary_ip_range {
+ range_name = "tf-test-secondary-range-update1"
+ ip_cidr_range = "192.168.10.0/24"
+ }
+ log_config {
+ aggregation_interval = "INTERVAL_10_MIN"
+ flow_sampling = 0.5
+ metadata = "INCLUDE_ALL_METADATA"
+ }
+}
+resource "google_compute_network" "custom-test" {
+ name = "test-network"
+ auto_create_subnetworks = false
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork#enable_flow_logs
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/docs.md
new file mode 100644
index 0000000..082212e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0029/docs.md
@@ -0,0 +1,10 @@
+
+VPC flow logs record information about all traffic, which is a vital tool in reviewing anomalous traffic.
+
+### Impact
+Limited auditing capability and awareness
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/Terraform.md
new file mode 100644
index 0000000..5150556
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/Terraform.md
@@ -0,0 +1,53 @@
+
+Disable project-wide SSH keys
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service_account_id"
+ display_name = "Service Account"
+ }
+
+ resource "google_compute_instance" "default" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ network_interface {
+ network = "default"
+
+ access_config {
+ // Ephemeral IP
+ }
+ }
+
+ metadata = {
+ block-project-ssh-keys = true
+ }
+
+ metadata_startup_script = "echo hi > /test.txt"
+
+ service_account {
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ email = google_service_account.default.email
+ scopes = ["cloud-platform"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/docs.md
new file mode 100644
index 0000000..00fbdf3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0030/docs.md
@@ -0,0 +1,10 @@
+
+Use of project-wide SSH keys means that a compromise of any one of these key pairs can result in all instances being compromised. It is recommended to use instance-level keys.
+
+### Impact
+Compromise of a single key pair compromises all instances
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/Terraform.md
new file mode 100644
index 0000000..c52aa99
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/Terraform.md
@@ -0,0 +1,32 @@
+
+Remove public IP
+
+```hcl
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ network_interface {
+ network = "default"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#access_config
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/docs.md
new file mode 100644
index 0000000..673dafc
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0031/docs.md
@@ -0,0 +1,13 @@
+
+Instances should not be publicly exposed to the internet
+
+### Impact
+Direct exposure of an instance to the public internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/compute/docs/ip-addresses#externaladdresses
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/Terraform.md
new file mode 100644
index 0000000..ff4b858
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/Terraform.md
@@ -0,0 +1,53 @@
+
+Disable serial port access
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service_account_id"
+ display_name = "Service Account"
+ }
+
+ resource "google_compute_instance" "default" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ network_interface {
+ network = "default"
+
+ access_config {
+ // Ephemeral IP
+ }
+ }
+
+ metadata = {
+ serial-port-enable = false
+ }
+
+ metadata_startup_script = "echo hi > /test.txt"
+
+ service_account {
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ email = google_service_account.default.email
+ scopes = ["cloud-platform"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/docs.md
new file mode 100644
index 0000000..8bb9a13
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0032/docs.md
@@ -0,0 +1,10 @@
+
+When serial port access is enabled, the access is not governed by network security rules meaning the port can be exposed publicly.
+
+### Impact
+Unrestricted network access to the serial console of the instance
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/Terraform.md
new file mode 100644
index 0000000..686fe62
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/Terraform.md
@@ -0,0 +1,54 @@
+
+Use managed keys
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service_account_id"
+ display_name = "Service Account"
+ }
+
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ kms_key_self_link = "something"
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ network_interface {
+ network = "default"
+
+ access_config {
+ // Ephemeral IP
+ }
+ }
+
+ metadata = {
+ foo = "bar"
+ }
+
+ metadata_startup_script = "echo hi > /test.txt"
+
+ service_account {
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ email = google_service_account.default.email
+ scopes = ["cloud-platform"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#kms_key_self_link
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/docs.md
new file mode 100644
index 0000000..85cfbc5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0033/docs.md
@@ -0,0 +1,10 @@
+
+Using unmanaged keys makes rotation and general management difficult.
+
+### Impact
+Using unmanaged keys does not allow for proper management
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/Terraform.md
new file mode 100644
index 0000000..1b36b8d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/Terraform.md
@@ -0,0 +1,23 @@
+
+Use managed keys to encrypt disks.
+
+```hcl
+ resource "google_compute_disk" "good_example" {
+ name = "test-disk"
+ type = "pd-ssd"
+ zone = "us-central1-a"
+ image = "debian-9-stretch-v20200805"
+ labels = {
+ environment = "dev"
+ }
+ physical_block_size_bytes = 4096
+ disk_encryption_key {
+ kms_key_self_link = "something"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_disk#kms_key_self_link
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/docs.md
new file mode 100644
index 0000000..45bf9f5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0034/docs.md
@@ -0,0 +1,10 @@
+
+Using unmanaged keys makes rotation and general management difficult.
+
+### Impact
+Using unmanaged keys does not allow for proper key management.
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/Terraform.md
new file mode 100644
index 0000000..60b1667
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/Terraform.md
@@ -0,0 +1,16 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "google_compute_firewall" "good_example" {
+ direction = "EGRESS"
+ allow {
+ protocol = "icmp"
+ }
+ destination_ranges = ["1.2.3.4/32"]
+}
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/docs.md
new file mode 100644
index 0000000..de39ac9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0035/docs.md
@@ -0,0 +1,15 @@
+
+Network security rules should not use very broad subnets.
+
+Where possible, segments should be broken into smaller subnets and avoid using the /0 subnet.
+
+### Impact
+The port is exposed for egress to the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/vpc/docs/using-firewalls
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/Terraform.md
new file mode 100644
index 0000000..2220b68
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/Terraform.md
@@ -0,0 +1,29 @@
+
+Enable OS Login at project level and remove instance-level overrides
+
+```hcl
+ resource "google_compute_instance" "default" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ metadata = {
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/docs.md
new file mode 100644
index 0000000..ef1c309
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0036/docs.md
@@ -0,0 +1,10 @@
+
+OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.
+
+### Impact
+Access via SSH key cannot be revoked automatically when an IAM user is removed.
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/Terraform.md
new file mode 100644
index 0000000..28195e9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/Terraform.md
@@ -0,0 +1,15 @@
+
+Reference a managed key rather than include the key in raw format.
+
+```hcl
+ resource "google_compute_disk" "good_example" {
+ disk_encryption_key {
+ kms_key_self_link = google_kms_crypto_key.my_crypto_key.id
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_disk#kms_key_self_link
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/docs.md
new file mode 100644
index 0000000..ad6faf1
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0037/docs.md
@@ -0,0 +1,13 @@
+
+Sensitive values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.
+
+### Impact
+The encryption key should be considered compromised as it is not stored securely.
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/compute/docs/disks/customer-supplied-encryption
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/Terraform.md
new file mode 100644
index 0000000..96546aa
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/Terraform.md
@@ -0,0 +1,15 @@
+
+Enforce a minimum TLS version of 1.2
+
+```hcl
+ resource "google_compute_ssl_policy" "good_example" {
+ name = "production-ssl-policy"
+ profile = "MODERN"
+ min_tls_version = "TLS_1_2"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_ssl_policy#min_tls_version
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/docs.md
new file mode 100644
index 0000000..cc52743
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0039/docs.md
@@ -0,0 +1,10 @@
+
+TLS versions prior to 1.2 are outdated and insecure. You should use 1.2 as aminimum version.
+
+### Impact
+Data in transit is not sufficiently secured
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/Terraform.md
new file mode 100644
index 0000000..a958b9c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/Terraform.md
@@ -0,0 +1,32 @@
+
+Enable Shielded VM VTPM
+
+```hcl
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ shielded_instance_config {
+ enable_vtpm = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#enable_vtpm
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/docs.md
new file mode 100644
index 0000000..b3523ef
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0041/docs.md
@@ -0,0 +1,13 @@
+
+The virtual TPM provides numerous security measures to your VM.
+
+### Impact
+Unable to prevent unwanted system state modification
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/blog/products/identity-security/virtual-trusted-platform-module-for-shielded-vms-security-in-plaintext
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/Terraform.md
new file mode 100644
index 0000000..9745c44
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/Terraform.md
@@ -0,0 +1,15 @@
+
+Enable OS Login at project level
+
+```hcl
+ resource "google_compute_project_metadata" "default" {
+ metadata = {
+ enable-oslogin = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_project_metadata#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/docs.md
new file mode 100644
index 0000000..ef1c309
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0042/docs.md
@@ -0,0 +1,10 @@
+
+OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.
+
+### Impact
+Access via SSH key cannot be revoked automatically when an IAM user is removed.
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/Terraform.md
new file mode 100644
index 0000000..04e04b3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/Terraform.md
@@ -0,0 +1,28 @@
+
+Disable IP forwarding
+
+```hcl
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ can_ip_forward = false
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#can_ip_forward
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/docs.md
new file mode 100644
index 0000000..b64da5d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0043/docs.md
@@ -0,0 +1,10 @@
+
+Disabling IP forwarding ensures the instance can only receive packets addressed to the instance and can only send packets with a source address of the instance.
+
+### Impact
+Instance can send/receive packets without the explicit instance address
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/Terraform.md
new file mode 100644
index 0000000..42e5a52
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/Terraform.md
@@ -0,0 +1,53 @@
+
+Remove use of default service account
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service_account_id"
+ display_name = "Service Account"
+ }
+
+ resource "google_compute_instance" "default" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ network_interface {
+ network = "default"
+
+ access_config {
+ // Ephemeral IP
+ }
+ }
+
+ metadata = {
+ foo = "bar"
+ }
+
+ metadata_startup_script = "echo hi > /test.txt"
+
+ service_account {
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ email = google_service_account.default.email
+ scopes = ["cloud-platform"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/docs.md
new file mode 100644
index 0000000..9b01375
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0044/docs.md
@@ -0,0 +1,10 @@
+
+The default service account has full project access. Instances should instead be assigned the minimal access they need.
+
+### Impact
+Instance has full access to the project
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/Terraform.md
new file mode 100644
index 0000000..393c959
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/Terraform.md
@@ -0,0 +1,32 @@
+
+Enable Shielded VM Integrity Monitoring
+
+```hcl
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ shielded_instance_config {
+ enable_integrity_monitoring = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#enable_vtpm
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/docs.md
new file mode 100644
index 0000000..80ab927
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0045/docs.md
@@ -0,0 +1,13 @@
+
+Integrity monitoring helps you understand and make decisions about the state of your VM instances.
+
+### Impact
+No visibility of VM instance boot state.
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/security/shielded-cloud/shielded-vm#integrity-monitoring
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/Terraform.md
new file mode 100644
index 0000000..a0ab93f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/Terraform.md
@@ -0,0 +1,32 @@
+
+Enable Shielded VM secure boot
+
+```hcl
+ resource "google_compute_instance" "good_example" {
+ name = "test"
+ machine_type = "e2-medium"
+ zone = "us-central1-a"
+
+ tags = ["foo", "bar"]
+
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-9"
+ }
+ }
+
+ // Local SSD disk
+ scratch_disk {
+ interface = "SCSI"
+ }
+
+ shielded_instance_config {
+ enable_secure_boot = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#enable_secure_boot
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/docs.md b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/docs.md
new file mode 100644
index 0000000..0f5d76f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/compute/AVD-GCP-0067/docs.md
@@ -0,0 +1,13 @@
+
+Secure boot helps ensure that the system only runs authentic software.
+
+### Impact
+Unable to verify digital signature of boot components, and unable to stop the boot process if verification fails.
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/security/shielded-cloud/shielded-vm#secure-boot
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/Terraform.md
new file mode 100644
index 0000000..a4b30f8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/Terraform.md
@@ -0,0 +1,26 @@
+
+Use RSA SHA512
+
+```hcl
+resource "google_dns_managed_zone" "example-zone" {
+ name = "example-zone"
+ dns_name = "example-${random_id.rnd.hex}.com."
+
+ dnssec_config {
+ state = "on"
+ default_key_specs {
+ algorithm = "rsasha512"
+ key_type = "keySigning"
+ }
+ default_key_specs {
+ algorithm = "rsasha512"
+ key_type = "zoneSigning"
+ }
+ }
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_managed_zone#algorithm
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/docs.md
new file mode 100644
index 0000000..8217592
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0012/docs.md
@@ -0,0 +1,10 @@
+
+RSA SHA1 is a weaker algorithm than SHA2-based algorithms such as RSA SHA256/512
+
+### Impact
+Less secure encryption algorithm than others available
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/Terraform.md
new file mode 100644
index 0000000..89a78e4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/Terraform.md
@@ -0,0 +1,25 @@
+
+Enable DNSSEC
+
+```hcl
+ resource "google_dns_managed_zone" "good_example" {
+ name = "example-zone"
+ dns_name = "example-${random_id.rnd.hex}.com."
+ description = "Example DNS zone"
+ labels = {
+ foo = "bar"
+ }
+ dnssec_config {
+ state = "on"
+ }
+ }
+
+ resource "random_id" "rnd" {
+ byte_length = 4
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_managed_zone#state
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/docs.md
new file mode 100644
index 0000000..7f1c42f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/dns/AVD-GCP-0013/docs.md
@@ -0,0 +1,10 @@
+
+DNSSEC authenticates DNS responses, preventing MITM attacks and impersonation.
+
+### Impact
+Unverified DNS responses could lead to man-in-the-middle attacks
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/Terraform.md
new file mode 100644
index 0000000..e2e7c1f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/Terraform.md
@@ -0,0 +1,16 @@
+
+Disable legacy metadata endpoints
+
+```hcl
+ resource "google_container_cluster" "good_example" {
+ node_config {
+ metadata = {
+ disable-legacy-endpoints = true
+ }
+ }
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#metadata
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/docs.md
new file mode 100644
index 0000000..e47e4e6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0048/docs.md
@@ -0,0 +1,19 @@
+
+The Compute Engine instance metadata server exposes legacy v0.1 and v1beta1 endpoints, which do not enforce metadata query headers.
+
+This is a feature in the v1 APIs that makes it more difficult for a potential attacker to retrieve instance metadata.
+
+Unless specifically required, we recommend you disable these legacy APIs.
+
+When setting the metadata block, the default value for disable-legacy-endpoints is set to true, they should not be explicitly enabled.
+
+### Impact
+Legacy metadata endpoints don't require metadata headers
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#protect_node_metadata_default_for_112
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/Terraform.md
new file mode 100644
index 0000000..b2c0423
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/Terraform.md
@@ -0,0 +1,44 @@
+
+Enable IP aliasing
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ ip_allocation_policy {}
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#ip_allocation_policy
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/docs.md
new file mode 100644
index 0000000..af002d8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0049/docs.md
@@ -0,0 +1,10 @@
+
+IP aliasing allows the reuse of public IPs internally, removing the need for a NAT gateway.
+
+### Impact
+Nodes need a NAT gateway to access local services
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/Terraform.md
new file mode 100644
index 0000000..99c4a78
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/Terraform.md
@@ -0,0 +1,15 @@
+
+Use limited permissions for service accounts to be effective
+
+```hcl
+ resource "google_container_cluster" "good_example" {
+ node_config {
+ service_account = "cool-service-account@example.com"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#service_account
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/docs.md
new file mode 100644
index 0000000..f3b63b8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0050/docs.md
@@ -0,0 +1,13 @@
+
+You should create and use a minimally privileged service account to run your GKE cluster instead of using the Compute Engine default service account.
+
+### Impact
+Service accounts with wide permissions can increase the risk of compromise
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/Terraform.md
new file mode 100644
index 0000000..80b8e63
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/Terraform.md
@@ -0,0 +1,46 @@
+
+Set cluster resource labels
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ resource_labels = {
+ "env" = "staging"
+ }
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#resource_labels
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/docs.md
new file mode 100644
index 0000000..538904b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0051/docs.md
@@ -0,0 +1,10 @@
+
+Labels make it easier to manage assets and differentiate between clusters and environments, allowing the mapping of computational resources to the wider organisational structure.
+
+### Impact
+Asset management can be limited/more difficult
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/Terraform.md
new file mode 100644
index 0000000..79773dd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/Terraform.md
@@ -0,0 +1,44 @@
+
+Enable StackDriver monitoring
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ monitoring_service = "monitoring.googleapis.com/kubernetes"
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#monitoring_service
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/docs.md
new file mode 100644
index 0000000..b71f2e6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0052/docs.md
@@ -0,0 +1,10 @@
+
+StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE to help you understand your application's behavior in production.
+
+### Impact
+Visibility will be reduced
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/Terraform.md
new file mode 100644
index 0000000..de70a02
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/Terraform.md
@@ -0,0 +1,49 @@
+
+Use private nodes and master authorised networks to prevent exposure
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "primary" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ master_authorized_networks_config {
+ cidr_blocks {
+ cidr_block = "10.10.128.0/24"
+ display_name = "internal"
+ }
+ }
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/docs.md
new file mode 100644
index 0000000..150da2d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0053/docs.md
@@ -0,0 +1,10 @@
+
+The GKE control plane is exposed to the public internet by default.
+
+### Impact
+GKE control plane exposed to public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/Terraform.md
new file mode 100644
index 0000000..4cce765
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/Terraform.md
@@ -0,0 +1,43 @@
+
+Use the COS image type
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "primary" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ }
+
+ resource "google_container_node_pool" "good_example" {
+ name = "my-node-pool"
+ cluster = google_container_cluster.primary.id
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ image_type = "COS"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#image_type
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/docs.md
new file mode 100644
index 0000000..95d4e0a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0054/docs.md
@@ -0,0 +1,10 @@
+
+GKE supports several OS image types but COS is the recommended OS image to use on cluster nodes for enhanced security
+
+### Impact
+COS is the recommended OS image to use on cluster nodes
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/Terraform.md
new file mode 100644
index 0000000..b303a42
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/Terraform.md
@@ -0,0 +1,12 @@
+
+Enable node shielding
+
+```hcl
+ resource "google_container_cluster" "good_example" {
+ enable_shielded_nodes = "true"
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#enable_shielded_nodes
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/docs.md
new file mode 100644
index 0000000..83d7af9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0055/docs.md
@@ -0,0 +1,15 @@
+
+CIS GKE Benchmark Recommendation: 6.5.5. Ensure Shielded GKE Nodes are Enabled
+
+Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.
+
+### Impact
+Node identity and integrity can't be verified without shielded GKE nodes
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#shielded_nodes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/Terraform.md
new file mode 100644
index 0000000..c17da33
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/Terraform.md
@@ -0,0 +1,46 @@
+
+Enable network policy
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ network_policy {
+ enabled = true
+ }
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#enabled
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/docs.md
new file mode 100644
index 0000000..0fb7a1a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0056/docs.md
@@ -0,0 +1,10 @@
+
+Enabling a network policy allows the segregation of network traffic by namespace
+
+### Impact
+Unrestricted inter-cluster communication
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/Terraform.md
new file mode 100644
index 0000000..99ac81b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/Terraform.md
@@ -0,0 +1,16 @@
+
+Set node metadata to SECURE or GKE_METADATA_SERVER
+
+```hcl
+ resource "google_container_node_pool" "good_example" {
+ node_config {
+ workload_metadata_config {
+ node_metadata = "SECURE"
+ }
+ }
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#node_metadata
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/docs.md
new file mode 100644
index 0000000..9ffd067
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0057/docs.md
@@ -0,0 +1,15 @@
+
+If the workload_metadata_config block within node_config is included, the node_metadata attribute should be configured securely.
+
+The attribute should be set to SECURE to use metadata concealment, or GKE_METADATA_SERVER if workload identity is enabled. This ensures that the VM metadata is not unnecessarily exposed to pods.
+
+### Impact
+Metadata that isn't concealed potentially risks leakage of sensitive data
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#create-concealed
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/Terraform.md
new file mode 100644
index 0000000..fc8b533
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/Terraform.md
@@ -0,0 +1,45 @@
+
+Enable automatic upgrades
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "primary" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ }
+
+ resource "google_container_node_pool" "good_example" {
+ name = "my-node-pool"
+ cluster = google_container_cluster.primary.id
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ management {
+ auto_upgrade = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_upgrade
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/docs.md
new file mode 100644
index 0000000..6c24632
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0058/docs.md
@@ -0,0 +1,10 @@
+
+Automatic updates keep nodes updated with the latest cluster master version.
+
+### Impact
+Nodes will need the cluster master version manually updating
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/Terraform.md
new file mode 100644
index 0000000..5d3b8af
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/Terraform.md
@@ -0,0 +1,46 @@
+
+Enable private cluster
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ private_cluster_config {
+ enable_private_nodes = true
+ }
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#enable_private_nodes
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/docs.md
new file mode 100644
index 0000000..a728250
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0059/docs.md
@@ -0,0 +1,10 @@
+
+Enabling private nodes on a cluster ensures the nodes are only available internally as they will only be assigned internal addresses.
+
+### Impact
+Nodes may be exposed to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/Terraform.md
new file mode 100644
index 0000000..b1a3e99
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/Terraform.md
@@ -0,0 +1,44 @@
+
+Enable StackDriver logging
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ logging_service = "logging.googleapis.com/kubernetes"
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#logging_service
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/docs.md
new file mode 100644
index 0000000..e646467
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0060/docs.md
@@ -0,0 +1,10 @@
+
+StackDriver logging provides a useful interface to all of stdout/stderr for each container and should be enabled for moitoring, debugging, etc.
+
+### Impact
+Visibility will be reduced
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/Terraform.md
new file mode 100644
index 0000000..d331a45
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/Terraform.md
@@ -0,0 +1,49 @@
+
+Enable master authorized networks
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "primary" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ master_authorized_networks_config {
+ cidr_blocks {
+ cidr_block = "10.10.128.0/24"
+ display_name = "internal"
+ }
+ }
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/docs.md
new file mode 100644
index 0000000..38f0803
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0061/docs.md
@@ -0,0 +1,10 @@
+
+Enabling authorized networks means you can restrict master access to a fixed set of CIDR ranges
+
+### Impact
+Unrestricted network access to the master
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/Terraform.md
new file mode 100644
index 0000000..9fe7d44
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/Terraform.md
@@ -0,0 +1,15 @@
+
+Switch to using RBAC permissions
+
+```hcl
+ resource "google_container_cluster" "good_example" {
+ # ...
+ # enable_legacy_abac not set
+ # ...
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#enable_legacy_abac
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/docs.md
new file mode 100644
index 0000000..47cab1e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0062/docs.md
@@ -0,0 +1,15 @@
+
+You should disable Attribute-Based Access Control (ABAC), and instead use Role-Based Access Control (RBAC) in GKE.
+
+RBAC has significant security advantages and is now stable in Kubernetes, so it’s time to disable ABAC.
+
+### Impact
+ABAC permissions are less secure than RBAC permissions
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#leave_abac_disabled_default_for_110
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/Terraform.md
new file mode 100644
index 0000000..997cc57
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/Terraform.md
@@ -0,0 +1,45 @@
+
+Enable automatic repair
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "primary" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ }
+
+ resource "google_container_node_pool" "good_example" {
+ name = "my-node-pool"
+ cluster = google_container_cluster.primary.id
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ management {
+ auto_repair = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_repair
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/docs.md
new file mode 100644
index 0000000..934773e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0063/docs.md
@@ -0,0 +1,10 @@
+
+Automatic repair will monitor nodes and attempt repair when a node fails multiple subsequent health checks
+
+### Impact
+Failing nodes will require manual repair.
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/Terraform.md
new file mode 100644
index 0000000..ccf52e7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/Terraform.md
@@ -0,0 +1,43 @@
+
+Use service account or OAuth for authentication
+
+```hcl
+ resource "google_service_account" "default" {
+ account_id = "service-account-id"
+ display_name = "Service Account"
+ }
+
+ resource "google_container_cluster" "good_example" {
+ name = "my-gke-cluster"
+ location = "us-central1"
+
+ # We can't create a cluster with no node pool defined, but we want to only use
+ # separately managed node pools. So we create the smallest possible default
+ # node pool and immediately delete it.
+ remove_default_node_pool = true
+ initial_node_count = 1
+ }
+
+ resource "google_container_node_pool" "primary_preemptible_nodes" {
+ name = "my-node-pool"
+ location = "us-central1"
+ cluster = google_container_cluster.primary.name
+ node_count = 1
+
+ node_config {
+ preemptible = true
+ machine_type = "e2-medium"
+
+ # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
+ service_account = google_service_account.default.email
+ oauth_scopes = [
+ "https://www.googleapis.com/auth/cloud-platform"
+ ]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#master_auth
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/docs.md b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/docs.md
new file mode 100644
index 0000000..e3a4144
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/gke/AVD-GCP-0064/docs.md
@@ -0,0 +1,15 @@
+
+It is recommended to use Service Accounts and OAuth as authentication methods for accessing the master in the container cluster.
+
+Basic authentication should be disabled by explicitly unsetting the username and password on the master_auth block.
+
+### Impact
+Username/password or certificate authentication methods are less secure
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict_authn_methods
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/Terraform.md
new file mode 100644
index 0000000..29c76f2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/Terraform.md
@@ -0,0 +1,18 @@
+
+Roles should be granted permissions and assigned to users
+
+```hcl
+ resource "google_project_iam_binding" "good_example" {
+ members = [
+ "group:test@example.com",
+ ]
+ }
+
+ resource "google_storage_bucket_iam_member" "good_example" {
+ member = "serviceAccount:test@example.com"
+ }
+```
+
+#### Remediation Links
+ - https://www.terraform.io/docs/providers/google/d/iam_policy.html#members
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/docs.md
new file mode 100644
index 0000000..5a2a928
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0003/docs.md
@@ -0,0 +1,19 @@
+
+Permissions should not be directly granted to users, you identify roles that contain the appropriate permissions, and then grant those roles to the user.
+
+Granting permissions to users quickly become unwieldy and complex to make large scale changes to remove access to a particular resource.
+
+Permissions should be granted on roles, groups, services accounts instead.
+
+### Impact
+Users shouldn't have permissions granted to them directly
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/iam/docs/overview#permissions
+
+- https://cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/Terraform.md
new file mode 100644
index 0000000..6992cec
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/Terraform.md
@@ -0,0 +1,22 @@
+
+Use specialised service accounts for specific purposes.
+
+```hcl
+ resource "google_service_account" "test" {
+ account_id = "account123"
+ display_name = "account123"
+ }
+
+ resource "google_folder_iam_member" "folder-123" {
+ folder = "folder-123"
+ role = "roles/whatever"
+ member = "serviceAccount:${google_service_account.test.email}"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_folder_iam
+
+ -
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/docs.md
new file mode 100644
index 0000000..9871f7b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0004/docs.md
@@ -0,0 +1,13 @@
+
+Default service accounts should not be used - consider creating specialised service accounts for individual purposes.
+
+### Impact
+Violation of principal of least privilege
+
+
+{{ remediationActions }}
+
+### Links
+-
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/Terraform.md
new file mode 100644
index 0000000..8d3a302
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/Terraform.md
@@ -0,0 +1,14 @@
+
+Provide access at the service-level instead of folder-level, if required
+
+```hcl
+ resource "google_folder_iam_binding" "folder-123" {
+ folder = "folder-123"
+ role = "roles/nothingInParticular"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_folder_iam
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/docs.md
new file mode 100644
index 0000000..952b459
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0005/docs.md
@@ -0,0 +1,13 @@
+
+Users with service account access at folder level can impersonate any service account. Instead, they should be given access to particular service accounts as required.
+
+### Impact
+Privilege escalation, impersonation of any/all services
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/iam/docs/impersonating-service-accounts
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/Terraform.md
new file mode 100644
index 0000000..1de6f0e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/Terraform.md
@@ -0,0 +1,22 @@
+
+Use specialised service accounts for specific purposes.
+
+```hcl
+ resource "google_service_account" "test" {
+ account_id = "account123"
+ display_name = "account123"
+ }
+
+ resource "google_project_iam_member" "project-123" {
+ project = "project-123"
+ role = "roles/whatever"
+ member = "serviceAccount:${google_service_account.test.email}"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam
+
+ -
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/docs.md
new file mode 100644
index 0000000..9871f7b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0006/docs.md
@@ -0,0 +1,13 @@
+
+Default service accounts should not be used - consider creating specialised service accounts for individual purposes.
+
+### Impact
+Violation of principal of least privilege
+
+
+{{ remediationActions }}
+
+### Links
+-
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/Terraform.md
new file mode 100644
index 0000000..7322e4d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/Terraform.md
@@ -0,0 +1,21 @@
+
+Limit service account access to minimal required set
+
+```hcl
+ resource "google_service_account" "test" {
+ account_id = "account123"
+ display_name = "account123"
+ email = "jim@tfsec.dev"
+ }
+
+ resource "google_project_iam_member" "project" {
+ project = "your-project-id"
+ role = "roles/logging.logWriter"
+ member = "serviceAccount:${google_service_account.test.email}"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/docs.md
new file mode 100644
index 0000000..c795075
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0007/docs.md
@@ -0,0 +1,13 @@
+
+Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account.
+
+### Impact
+Cloud account takeover if a resource using a service account is compromised
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/iam/docs/understanding-roles
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/Terraform.md
new file mode 100644
index 0000000..733b20e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/Terraform.md
@@ -0,0 +1,22 @@
+
+Use specialised service accounts for specific purposes.
+
+```hcl
+ resource "google_service_account" "test" {
+ account_id = "account123"
+ display_name = "account123"
+ }
+
+ resource "google_organization_iam_member" "org-123" {
+ org_id = "org-123"
+ role = "roles/whatever"
+ member = "serviceAccount:${google_service_account.test.email}"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam
+
+ -
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/docs.md
new file mode 100644
index 0000000..9871f7b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0008/docs.md
@@ -0,0 +1,13 @@
+
+Default service accounts should not be used - consider creating specialised service accounts for individual purposes.
+
+### Impact
+Violation of principal of least privilege
+
+
+{{ remediationActions }}
+
+### Links
+-
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/Terraform.md
new file mode 100644
index 0000000..367d3eb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/Terraform.md
@@ -0,0 +1,14 @@
+
+Provide access at the service-level instead of organization-level, if required
+
+```hcl
+ resource "google_organization_iam_binding" "organization-123" {
+ org_id = "org-123"
+ role = "roles/nothingInParticular"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/docs.md
new file mode 100644
index 0000000..f410642
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0009/docs.md
@@ -0,0 +1,13 @@
+
+Users with service account access at organization level can impersonate any service account. Instead, they should be given access to particular service accounts as required.
+
+### Impact
+Privilege escalation, impersonation of any/all services
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/iam/docs/impersonating-service-accounts
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/Terraform.md
new file mode 100644
index 0000000..8eeacd7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/Terraform.md
@@ -0,0 +1,16 @@
+
+Disable automatic default network creation
+
+```hcl
+ resource "google_project" "good_example" {
+ name = "My Project"
+ project_id = "your-project-id"
+ org_id = "1234567"
+ auto_create_network = false
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project#auto_create_network
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/docs.md
new file mode 100644
index 0000000..23f8d8b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0010/docs.md
@@ -0,0 +1,10 @@
+
+The default network which is provided for a project contains multiple insecure firewall rules which allow ingress to the project's infrastructure. Creation of this network should therefore be disabled.
+
+### Impact
+Exposure of internal infrastructure/services to public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/Terraform.md
new file mode 100644
index 0000000..b3fe7b2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/Terraform.md
@@ -0,0 +1,14 @@
+
+Provide access at the service-level instead of project-level, if required
+
+```hcl
+ resource "google_project_iam_binding" "project-123" {
+ project = "project-123"
+ role = "roles/nothingInParticular"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/docs.md
new file mode 100644
index 0000000..848bbb3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0011/docs.md
@@ -0,0 +1,13 @@
+
+Users with service account access at project level can impersonate any service account. Instead, they should be given access to particular service accounts as required.
+
+### Impact
+Privilege escalation, impersonation of any/all services
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/iam/docs/impersonating-service-accounts
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/Terraform.md
new file mode 100644
index 0000000..59db56d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/Terraform.md
@@ -0,0 +1,35 @@
+
+Set conditions on this provider, for example by restricting it to only be allowed from repositories in your GitHub organization
+
+```hcl
+ resource "google_iam_workload_identity_pool" "github" {
+ provider = google
+ project = data.google_project.project.project_id
+ workload_identity_pool_id = "github"
+ }
+
+ resource "google_iam_workload_identity_pool_provider" "github" {
+ provider = google
+ project = data.google_project.project.project_id
+ workload_identity_pool_id = google_iam_workload_identity_pool.github-actions[0].workload_identity_pool_id
+ workload_identity_pool_provider_id = "github"
+
+ attribute_condition = "assertion.repository_owner=='your-github-organization'"
+
+ attribute_mapping = {
+ "google.subject" = "assertion.sub"
+ "attribute.actor" = "assertion.actor"
+ "attribute.aud" = "assertion.aud"
+ "attribute.repository" = "assertion.repository"
+ }
+
+ oidc {
+ issuer_uri = "https://token.actions.githubusercontent.com"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider#attribute_condition
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/docs.md b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/docs.md
new file mode 100644
index 0000000..ed1e8ce
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/iam/AVD-GCP-0068/docs.md
@@ -0,0 +1,13 @@
+
+In GitHub Actions, one can authenticate to Google Cloud by setting values for workload_identity_provider and service_account and requesting a short-lived OIDC token which is then used to execute commands as that Service Account. If you don't specify a condition in the workload identity provider pool configuration, then any GitHub Action can assume this role and act as that Service Account.
+
+### Impact
+Allows an external attacker to authenticate as the attached service account and act with its permissions
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.revblock.dev/exploiting-misconfigured-google-cloud-service-accounts-from-github-actions/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/Terraform.md
new file mode 100644
index 0000000..9fb0a77
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/Terraform.md
@@ -0,0 +1,24 @@
+
+Set key rotation period to 90 days
+
+```hcl
+ resource "google_kms_key_ring" "keyring" {
+ name = "keyring-example"
+ location = "global"
+ }
+
+ resource "google_kms_crypto_key" "example-key" {
+ name = "crypto-key-example"
+ key_ring = google_kms_key_ring.keyring.id
+ rotation_period = "7776000s"
+
+ lifecycle {
+ prevent_destroy = true
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key#rotation_period
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/docs.md b/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/docs.md
new file mode 100644
index 0000000..db99acb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/kms/AVD-GCP-0065/docs.md
@@ -0,0 +1,10 @@
+
+Keys should be rotated on a regular basis to limit exposure if a given key should become compromised.
+
+### Impact
+Exposure is greater if the same keys are used over a long period
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/Terraform.md
new file mode 100644
index 0000000..b0c0551
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable temporary file logging for all files
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_temp_files"
+ value = "0"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/docs.md
new file mode 100644
index 0000000..028480f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0014/docs.md
@@ -0,0 +1,13 @@
+
+Temporary files are not logged by default. To log all temporary files, a value of `0` should set in the `log_temp_files` flag - as all files greater in size than the number of bytes set in this flag will be logged.
+
+### Impact
+Use of temporary files will not be logged
+
+
+{{ remediationActions }}
+
+### Links
+- https://postgresqlco.nf/doc/en/param/log_temp_files/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/Terraform.md
new file mode 100644
index 0000000..74819cc
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/Terraform.md
@@ -0,0 +1,27 @@
+
+Enforce SSL for all connections
+
+```hcl
+ resource "google_sql_database_instance" "postgres" {
+ name = "postgres-instance-a"
+ database_version = "POSTGRES_11"
+
+ settings {
+ tier = "db-f1-micro"
+
+ ip_configuration {
+ ipv4_enabled = false
+ authorized_networks {
+ value = "108.12.12.0/24"
+ name = "internal"
+ }
+ require_ssl = true
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/docs.md
new file mode 100644
index 0000000..1917b5a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0015/docs.md
@@ -0,0 +1,13 @@
+
+In-transit data should be encrypted so that if traffic is intercepted data will not be exposed in plaintext to attackers.
+
+### Impact
+Intercepted data can be read in transit
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/sql/docs/mysql/configure-ssl-instance
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/Terraform.md
new file mode 100644
index 0000000..43352d2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable connection logging.
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_connections"
+ value = "on"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/docs.md
new file mode 100644
index 0000000..2ac6b74
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0016/docs.md
@@ -0,0 +1,13 @@
+
+Logging connections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.
+
+### Impact
+Insufficient diagnostic data.
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-CONNECTIONS
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/Terraform.md
new file mode 100644
index 0000000..d798390
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/Terraform.md
@@ -0,0 +1,26 @@
+
+Remove public access from database instances
+
+```hcl
+ resource "google_sql_database_instance" "postgres" {
+ name = "postgres-instance-a"
+ database_version = "POSTGRES_11"
+
+ settings {
+ tier = "db-f1-micro"
+
+ ip_configuration {
+ ipv4_enabled = false
+ authorized_networks {
+ value = "10.0.0.1/24"
+ name = "internal"
+ }
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/docs.md
new file mode 100644
index 0000000..48ed19d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0017/docs.md
@@ -0,0 +1,13 @@
+
+Database instances should be configured so that they are not available over the public internet, but to internal compute resources which access them.
+
+### Impact
+Public exposure of sensitive data
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cloudconformity.com/knowledge-base/gcp/CloudSQL/publicly-accessible-cloud-sql-instances.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/Terraform.md
new file mode 100644
index 0000000..27f5f87
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/Terraform.md
@@ -0,0 +1,21 @@
+
+Set the minimum log severity to at least ERROR
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_min_messages"
+ value = "WARNING"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/docs.md
new file mode 100644
index 0000000..d1e21e3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0018/docs.md
@@ -0,0 +1,15 @@
+
+Setting the minimum log severity too high will cause errors not to be logged
+
+### Impact
+Loss of error logging
+
+
+{{ remediationActions }}
+
+### Links
+- https://postgresqlco.nf/doc/en/param/log_min_messages/
+
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-MIN-MESSAGES
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/Terraform.md
new file mode 100644
index 0000000..d04338a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/Terraform.md
@@ -0,0 +1,21 @@
+
+Disable cross database ownership chaining
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "SQLSERVER_2017_STANDARD"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "cross db ownership chaining"
+ value = "off"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/docs.md
new file mode 100644
index 0000000..4daa9a9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0019/docs.md
@@ -0,0 +1,13 @@
+
+Cross-database ownership chaining, also known as cross-database chaining, is a security feature of SQL Server that allows users of databases access to other databases besides the one they are currently using.
+
+### Impact
+Unintended access to sensitive data
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option?view=sql-server-ver15
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/Terraform.md
new file mode 100644
index 0000000..d50a8ee
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable lock wait logging.
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_lock_waits"
+ value = "on"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/docs.md
new file mode 100644
index 0000000..3ae6dd4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0020/docs.md
@@ -0,0 +1,13 @@
+
+Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.
+
+### Impact
+Issues leading to denial of service may not be identified.
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-LOCK-WAITS
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/Terraform.md
new file mode 100644
index 0000000..99dae56
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/Terraform.md
@@ -0,0 +1,21 @@
+
+Disable minimum duration statement logging completely
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_min_duration_statement"
+ value = "-1"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/docs.md
new file mode 100644
index 0000000..649e695
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0021/docs.md
@@ -0,0 +1,13 @@
+
+Logging of statements which could contain sensitive data is not advised, therefore this setting should preclude all statements from being logged.
+
+### Impact
+Sensitive data could be exposed in the database logs.
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-MIN-DURATION-STATEMENT
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/Terraform.md
new file mode 100644
index 0000000..d10cd52
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable disconnection logging.
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_disconnections"
+ value = "on"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/docs.md
new file mode 100644
index 0000000..bf8acde
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0022/docs.md
@@ -0,0 +1,13 @@
+
+Logging disconnections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.
+
+### Impact
+Insufficient diagnostic data.
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-DISCONNECTIONS
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/Terraform.md
new file mode 100644
index 0000000..c8c3593
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/Terraform.md
@@ -0,0 +1,21 @@
+
+Disable contained database authentication
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "SQLSERVER_2017_STANDARD"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "contained database authentication"
+ value = "off"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/docs.md
new file mode 100644
index 0000000..386e858
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0023/docs.md
@@ -0,0 +1,13 @@
+
+Users with ALTER permissions on users can grant access to a contained database without the knowledge of an administrator
+
+### Impact
+Access can be granted without knowledge of the database administrator
+
+
+{{ remediationActions }}
+
+### Links
+- https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/contained-database-authentication-server-configuration-option?view=sql-server-ver15
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/Terraform.md
new file mode 100644
index 0000000..920ab13
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/Terraform.md
@@ -0,0 +1,36 @@
+
+Enable automated backups
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ backup_configuration {
+ enabled = true
+ }
+ }
+ }
+
+```
+```hcl
+resource "google_sql_database_instance" "new_instance_sql_replica" {
+ name = "replica"
+ region = "europe-west3"
+ database_version = "POSTGRES_14"
+ master_instance_name = google_sql_database_instance.instance[0].name
+ deletion_protection = terraform.workspace == "prod" ? true : false
+
+ replica_configuration {
+ connect_retry_interval = 0
+ failover_target = false
+ master_heartbeat_period = 0
+ }
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#settings.backup_configuration.enabled=true
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/docs.md
new file mode 100644
index 0000000..22329e8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0024/docs.md
@@ -0,0 +1,13 @@
+
+Automated backups are not enabled by default. Backups are an easy way to restore data in a corruption or data-loss scenario.
+
+### Impact
+No recovery of lost or corrupted data
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/sql/docs/mysql/backup-recovery/backups
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/Terraform.md
new file mode 100644
index 0000000..b7392c9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/Terraform.md
@@ -0,0 +1,21 @@
+
+Enable checkpoints logging.
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "POSTGRES_12"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "log_checkpoints"
+ value = "on"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/docs.md
new file mode 100644
index 0000000..09ee381
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0025/docs.md
@@ -0,0 +1,13 @@
+
+Logging checkpoints provides useful diagnostic data, which can identify performance issues in an application and potential DoS vectors.
+
+### Impact
+Insufficient diagnostic data.
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-CHECKPOINTS
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/Terraform.md
new file mode 100644
index 0000000..7cf38a2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/Terraform.md
@@ -0,0 +1,23 @@
+
+Disable the local infile setting
+
+```hcl
+ resource "google_sql_database_instance" "db" {
+ name = "db"
+ database_version = "MYSQL_5_6"
+ region = "us-central1"
+ settings {
+ database_flags {
+ name = "local_infile"
+ value = "off"
+ }
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance
+
+ - https://dev.mysql.com/doc/refman/8.0/en/load-data-local-security.html
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/docs.md b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/docs.md
new file mode 100644
index 0000000..f3674d2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/sql/AVD-GCP-0026/docs.md
@@ -0,0 +1,13 @@
+
+Arbitrary files can be read from the system using LOAD_DATA unless this setting is disabled.
+
+### Impact
+Arbitrary files read by attackers when combined with a SQL injection vulnerability.
+
+
+{{ remediationActions }}
+
+### Links
+- https://dev.mysql.com/doc/refman/8.0/en/load-data-local-security.html
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/Terraform.md
new file mode 100644
index 0000000..2e6ec1e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/Terraform.md
@@ -0,0 +1,17 @@
+
+Restrict public access to the bucket.
+
+```hcl
+ resource "google_storage_bucket_iam_binding" "binding" {
+ bucket = google_storage_bucket.default.name
+ role = "roles/storage.admin"
+ members = [
+ "user:jane@example.com",
+ ]
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_iam#member/members
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/docs.md
new file mode 100644
index 0000000..c172693
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0001/docs.md
@@ -0,0 +1,13 @@
+
+Using 'allUsers' or 'allAuthenticatedUsers' as members in an IAM member/binding causes data to be exposed outside of the organisation.
+
+### Impact
+Public exposure of sensitive data.
+
+
+{{ remediationActions }}
+
+### Links
+- https://jbrojbrojbro.medium.com/you-make-the-rules-with-authentication-controls-for-cloud-storage-53c32543747b
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/Terraform.md
new file mode 100644
index 0000000..7e590ca
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/Terraform.md
@@ -0,0 +1,28 @@
+
+Enable uniform bucket level access to provide a uniform permissioning system.
+
+```hcl
+ resource "google_storage_bucket" "static-site" {
+ name = "image-store.com"
+ location = "EU"
+ force_destroy = true
+
+ uniform_bucket_level_access = true
+
+ website {
+ main_page_suffix = "index.html"
+ not_found_page = "404.html"
+ }
+ cors {
+ origin = ["http://image-store.com"]
+ method = ["GET", "HEAD", "PUT", "POST", "DELETE"]
+ response_header = ["*"]
+ max_age_seconds = 3600
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket#uniform_bucket_level_access
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/docs.md
new file mode 100644
index 0000000..6b9dfe8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0002/docs.md
@@ -0,0 +1,15 @@
+
+When you enable uniform bucket-level access on a bucket, Access Control Lists (ACLs) are disabled, and only bucket-level Identity and Access Management (IAM) permissions grant access to that bucket and the objects it contains. You revoke all access granted by object ACLs and the ability to administrate permissions using bucket ACLs.
+
+### Impact
+ACLs are difficult to manage and often lead to incorrect/unintended configurations.
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/storage/docs/uniform-bucket-level-access
+
+- https://jbrojbrojbro.medium.com/you-make-the-rules-with-authentication-controls-for-cloud-storage-53c32543747b
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/Terraform.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/Terraform.md
new file mode 100644
index 0000000..fa2bf1c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/Terraform.md
@@ -0,0 +1,20 @@
+
+Encrypt Cloud Storage buckets using customer-managed keys.
+
+```hcl
+ resource "google_storage_bucket" "default" {
+ name = "my-default-bucket"
+ location = "EU"
+ force_destroy = true
+ uniform_bucket_level_access = true
+
+ encryption {
+ default_kms_key_name = "projects/my-pet-project/locations/us-east1/keyRings/my-key-ring/cryptoKeys/my-key"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket#encryption
+
diff --git a/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/docs.md b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/docs.md
new file mode 100644
index 0000000..e6b79d1
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/google/storage/AVD-GCP-0066/docs.md
@@ -0,0 +1,13 @@
+
+Using unmanaged keys makes rotation and general management difficult.
+
+### Impact
+Using unmanaged keys does not allow for proper key management.
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/storage/docs/encryption/customer-managed-keys
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0001/docs.md
new file mode 100644
index 0000000..3932121
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0001/docs.md
@@ -0,0 +1,13 @@
+
+Disable anonymous requests to the API server.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0002/docs.md
new file mode 100644
index 0000000..3dd60c0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0002/docs.md
@@ -0,0 +1,13 @@
+
+Do not use token based authentication.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0003/docs.md
new file mode 100644
index 0000000..ba1ad62
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0003/docs.md
@@ -0,0 +1,13 @@
+
+This admission controller rejects all net-new usage of the Service field externalIPs.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0004/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0004/docs.md
new file mode 100644
index 0000000..d330514
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0004/docs.md
@@ -0,0 +1,13 @@
+
+Use https for kubelet connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0005/docs.md
new file mode 100644
index 0000000..c8470a9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0005/docs.md
@@ -0,0 +1,13 @@
+
+Enable certificate based kubelet authentication.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0006/docs.md
new file mode 100644
index 0000000..b435b63
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0006/docs.md
@@ -0,0 +1,13 @@
+
+Verify kubelet's certificate before establishing connection.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0007/docs.md
new file mode 100644
index 0000000..5d19e55
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0007/docs.md
@@ -0,0 +1,13 @@
+
+Do not always authorize all requests.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0008/docs.md
new file mode 100644
index 0000000..d01328e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0008/docs.md
@@ -0,0 +1,13 @@
+
+Restrict kubelet nodes to reading only objects associated with them.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0009/docs.md
new file mode 100644
index 0000000..4363c0f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0009/docs.md
@@ -0,0 +1,13 @@
+
+Turn on Role Based Access Control.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0010/docs.md
new file mode 100644
index 0000000..bbe63e2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0010/docs.md
@@ -0,0 +1,13 @@
+
+Limit the rate at which the API server accepts requests.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0011/docs.md
new file mode 100644
index 0000000..0c2f5ce
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0011/docs.md
@@ -0,0 +1,13 @@
+
+Do not allow all requests.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0012/docs.md
new file mode 100644
index 0000000..f9792e7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0012/docs.md
@@ -0,0 +1,13 @@
+
+Always pull images.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0013/docs.md
new file mode 100644
index 0000000..3820f7c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0013/docs.md
@@ -0,0 +1,13 @@
+
+The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0014/docs.md
new file mode 100644
index 0000000..a1623ab
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0014/docs.md
@@ -0,0 +1,13 @@
+
+Automate service accounts management.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0015/docs.md
new file mode 100644
index 0000000..39fc343
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0015/docs.md
@@ -0,0 +1,13 @@
+
+Reject creating objects in a namespace that is undergoing termination.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0016/docs.md
new file mode 100644
index 0000000..f35fb8b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0016/docs.md
@@ -0,0 +1,13 @@
+
+Limit the Node and Pod objects that a kubelet could modify.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0017/docs.md
new file mode 100644
index 0000000..d12c420
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0017/docs.md
@@ -0,0 +1,13 @@
+
+Do not disable the secure port.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0018/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0018/docs.md
new file mode 100644
index 0000000..c82fe71
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0018/docs.md
@@ -0,0 +1,13 @@
+
+Disable profiling, if not needed.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0019/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0019/docs.md
new file mode 100644
index 0000000..17be6b4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0019/docs.md
@@ -0,0 +1,13 @@
+
+Enable auditing on the Kubernetes API Server and set the desired audit log path.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0020/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0020/docs.md
new file mode 100644
index 0000000..abb6d4c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0020/docs.md
@@ -0,0 +1,13 @@
+
+Retain the logs for at least 30 days or as appropriate.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0021/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0021/docs.md
new file mode 100644
index 0000000..f455100
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0021/docs.md
@@ -0,0 +1,13 @@
+
+Retain 10 or an appropriate number of old log files.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0022/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0022/docs.md
new file mode 100644
index 0000000..f0480f9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0022/docs.md
@@ -0,0 +1,13 @@
+
+Rotate log files on reaching 100 MB or as appropriate.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0024/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0024/docs.md
new file mode 100644
index 0000000..2792499
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0024/docs.md
@@ -0,0 +1,13 @@
+
+Validate service account before validating token.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0025/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0025/docs.md
new file mode 100644
index 0000000..2a05520
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0025/docs.md
@@ -0,0 +1,13 @@
+
+Explicitly set a service account public key file for service accounts on the apiserver.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0026/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0026/docs.md
new file mode 100644
index 0000000..0730884
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0026/docs.md
@@ -0,0 +1,13 @@
+
+etcd should be configured to make use of TLS encryption for client connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0027/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0027/docs.md
new file mode 100644
index 0000000..0bf8657
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0027/docs.md
@@ -0,0 +1,13 @@
+
+Setup TLS connection on the API server.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0028/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0028/docs.md
new file mode 100644
index 0000000..0bf8657
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0028/docs.md
@@ -0,0 +1,13 @@
+
+Setup TLS connection on the API server.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0029/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0029/docs.md
new file mode 100644
index 0000000..0730884
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0029/docs.md
@@ -0,0 +1,13 @@
+
+etcd should be configured to make use of TLS encryption for client connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0030/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0030/docs.md
new file mode 100644
index 0000000..fa1e93b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0030/docs.md
@@ -0,0 +1,13 @@
+
+Encrypt etcd key-value store.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0033/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0033/docs.md
new file mode 100644
index 0000000..7231e4f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0033/docs.md
@@ -0,0 +1,13 @@
+
+Activate garbage collector on pod termination, as appropriate.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0034/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0034/docs.md
new file mode 100644
index 0000000..c82fe71
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0034/docs.md
@@ -0,0 +1,13 @@
+
+Disable profiling, if not needed.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0035/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0035/docs.md
new file mode 100644
index 0000000..bf011ea
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0035/docs.md
@@ -0,0 +1,13 @@
+
+Use individual service account credentials for each controller.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0036/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0036/docs.md
new file mode 100644
index 0000000..694aa39
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0036/docs.md
@@ -0,0 +1,13 @@
+
+Explicitly set a service account private key file for service accounts on the controller manager.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0037/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0037/docs.md
new file mode 100644
index 0000000..893b1e8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0037/docs.md
@@ -0,0 +1,13 @@
+
+Allow pods to verify the API server's serving certificate before establishing connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0038/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0038/docs.md
new file mode 100644
index 0000000..767dab0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0038/docs.md
@@ -0,0 +1,13 @@
+
+Enable kubelet server certificate rotation on controller-manager.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0039/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0039/docs.md
new file mode 100644
index 0000000..637986c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0039/docs.md
@@ -0,0 +1,13 @@
+
+Do not bind the scheduler service to non-loopback insecure addresses.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0040/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0040/docs.md
new file mode 100644
index 0000000..c82fe71
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0040/docs.md
@@ -0,0 +1,13 @@
+
+Disable profiling, if not needed.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0041/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0041/docs.md
new file mode 100644
index 0000000..637986c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0041/docs.md
@@ -0,0 +1,13 @@
+
+Do not bind the scheduler service to non-loopback insecure addresses.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0042/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0042/docs.md
new file mode 100644
index 0000000..b15ca5d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0042/docs.md
@@ -0,0 +1,13 @@
+
+Configure TLS encryption for the etcd service.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0043/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0043/docs.md
new file mode 100644
index 0000000..dd8a89f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0043/docs.md
@@ -0,0 +1,13 @@
+
+Enable client authentication on etcd service.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0044/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0044/docs.md
new file mode 100644
index 0000000..2ed5105
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0044/docs.md
@@ -0,0 +1,13 @@
+
+Do not use self-signed certificates for TLS.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0045/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0045/docs.md
new file mode 100644
index 0000000..08770a0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0045/docs.md
@@ -0,0 +1,13 @@
+
+etcd should be configured to make use of TLS encryption for peer connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0046/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0046/docs.md
new file mode 100644
index 0000000..2260332
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0046/docs.md
@@ -0,0 +1,13 @@
+
+etcd should be configured for peer authentication.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0047/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0047/docs.md
new file mode 100644
index 0000000..2ed5105
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0047/docs.md
@@ -0,0 +1,13 @@
+
+Do not use self-signed certificates for TLS.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0048/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0048/docs.md
new file mode 100644
index 0000000..c8cb4e5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0048/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the API server pod specification file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0049/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0049/docs.md
new file mode 100644
index 0000000..eb23a15
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0049/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the API server pod specification file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0050/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0050/docs.md
new file mode 100644
index 0000000..483f73f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0050/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the controller manager pod specification file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0051/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0051/docs.md
new file mode 100644
index 0000000..81ccd22
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0051/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the controller manager pod specification file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0052/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0052/docs.md
new file mode 100644
index 0000000..6afafed
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0052/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the scheduler pod specification file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0053/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0053/docs.md
new file mode 100644
index 0000000..1abbdb9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0053/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the scheduler pod specification file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0054/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0054/docs.md
new file mode 100644
index 0000000..041c52e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0054/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the etcd pod specification file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0055/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0055/docs.md
new file mode 100644
index 0000000..5b50c6a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0055/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the etcd pod specification file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0056/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0056/docs.md
new file mode 100644
index 0000000..3a20fa1
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0056/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the container network interface file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0057/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0057/docs.md
new file mode 100644
index 0000000..6daff67
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0057/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the container network interface file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0058/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0058/docs.md
new file mode 100644
index 0000000..b8b24d1
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0058/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the etcd data directory has permissions of 700 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0059/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0059/docs.md
new file mode 100644
index 0000000..c250d00
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0059/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the etcd data directory ownership is set to etcd:etcd.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0060/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0060/docs.md
new file mode 100644
index 0000000..4e499a1
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0060/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the admin config file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0061/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0061/docs.md
new file mode 100644
index 0000000..1b6a6fb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0061/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the admin config file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0062/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0062/docs.md
new file mode 100644
index 0000000..299023d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0062/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the scheduler config file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0063/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0063/docs.md
new file mode 100644
index 0000000..ad17c0c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0063/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the scheduler config file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0064/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0064/docs.md
new file mode 100644
index 0000000..9699676
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0064/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the controller-manager config file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0065/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0065/docs.md
new file mode 100644
index 0000000..1676a6a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0065/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the controller-manager config file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0066/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0066/docs.md
new file mode 100644
index 0000000..10a2d4c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0066/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the Kubernetes PKI directory and file file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0067/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0067/docs.md
new file mode 100644
index 0000000..bcdbf09
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0067/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the Kubernetes PKI key file permission is set to 600.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0068/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0068/docs.md
new file mode 100644
index 0000000..50da8c8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0068/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the Kubernetes PKI certificate file permission is set to 600.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0069/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0069/docs.md
new file mode 100644
index 0000000..ae1729f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0069/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the kubelet service file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0070/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0070/docs.md
new file mode 100644
index 0000000..3eb21b0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0070/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the kubelet service file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0071/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0071/docs.md
new file mode 100644
index 0000000..d133f51
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0071/docs.md
@@ -0,0 +1,13 @@
+
+If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0072/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0072/docs.md
new file mode 100644
index 0000000..d840840
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0072/docs.md
@@ -0,0 +1,13 @@
+
+If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0073/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0073/docs.md
new file mode 100644
index 0000000..a946dd2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0073/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the kubelet.conf file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0074/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0074/docs.md
new file mode 100644
index 0000000..4345ccd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0074/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the kubelet.conf file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0075/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0075/docs.md
new file mode 100644
index 0000000..49d5415
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0075/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the certificate authorities file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0076/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0076/docs.md
new file mode 100644
index 0000000..3a61c69
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0076/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the certificate authorities file ownership is set to root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0077/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0077/docs.md
new file mode 100644
index 0000000..d8cb32d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0077/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 600 or more restrictive.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0078/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0078/docs.md
new file mode 100644
index 0000000..a3fb0dd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0078/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0079/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0079/docs.md
new file mode 100644
index 0000000..b1c5fcc
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0079/docs.md
@@ -0,0 +1,13 @@
+
+Disable anonymous requests to the Kubelet server.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0080/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0080/docs.md
new file mode 100644
index 0000000..91526c5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0080/docs.md
@@ -0,0 +1,13 @@
+
+Do not allow all requests. Enable explicit authorization.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0081/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0081/docs.md
new file mode 100644
index 0000000..db6706b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0081/docs.md
@@ -0,0 +1,13 @@
+
+Enable Kubelet authentication using certificates.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0082/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0082/docs.md
new file mode 100644
index 0000000..779adf6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0082/docs.md
@@ -0,0 +1,13 @@
+
+Disable the read-only port.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0083/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0083/docs.md
new file mode 100644
index 0000000..a0e8350
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0083/docs.md
@@ -0,0 +1,13 @@
+
+Protect tuned kernel parameters from overriding kubelet default kernel parameter values.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0084/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0084/docs.md
new file mode 100644
index 0000000..1b7181c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0084/docs.md
@@ -0,0 +1,13 @@
+
+Allow Kubelet to manage iptables.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0085/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0085/docs.md
new file mode 100644
index 0000000..b4fc75e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0085/docs.md
@@ -0,0 +1,13 @@
+
+Do not disable timeouts on streaming connections.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0086/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0086/docs.md
new file mode 100644
index 0000000..ec5d0ba
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0086/docs.md
@@ -0,0 +1,13 @@
+
+Do not override node hostnames.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0087/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0087/docs.md
new file mode 100644
index 0000000..b00ddec
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0087/docs.md
@@ -0,0 +1,13 @@
+
+Security relevant information should be captured. The --event-qps flag on the Kubelet can be used to limit the rate at which events are gathered
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0088/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0088/docs.md
new file mode 100644
index 0000000..561e5d0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0088/docs.md
@@ -0,0 +1,13 @@
+
+Setup TLS connection on the Kubelets.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0089/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0089/docs.md
new file mode 100644
index 0000000..561e5d0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0089/docs.md
@@ -0,0 +1,13 @@
+
+Setup TLS connection on the Kubelets.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0090/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0090/docs.md
new file mode 100644
index 0000000..7e993cb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0090/docs.md
@@ -0,0 +1,13 @@
+
+Enable kubelet client certificate rotation.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0091/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0091/docs.md
new file mode 100644
index 0000000..0605d0e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0091/docs.md
@@ -0,0 +1,13 @@
+
+Enable kubelet server certificate rotation.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0092/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0092/docs.md
new file mode 100644
index 0000000..59da13f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KCV-0092/docs.md
@@ -0,0 +1,13 @@
+
+Ensure that the Kubelet is configured to only use strong cryptographic ciphers.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cisecurity.org/benchmark/kubernetes
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0001/docs.md
new file mode 100644
index 0000000..2f43719
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0001/docs.md
@@ -0,0 +1,13 @@
+
+A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0002/docs.md
new file mode 100644
index 0000000..101f2a7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0002/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'AppArmor', the AppArmor key must be set to the runtime/default profile or to be undefined.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0003/docs.md
new file mode 100644
index 0000000..27e743b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0003/docs.md
@@ -0,0 +1,13 @@
+
+The container should drop all default capabilities and add only those that are needed for its execution.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0005/docs.md
new file mode 100644
index 0000000..e5bf799
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0005/docs.md
@@ -0,0 +1,13 @@
+
+SYS_ADMIN gives the processes running inside the container privileges that are equivalent to root.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-capabilities-add-index-sys-admin/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0006/docs.md
new file mode 100644
index 0000000..702985f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0006/docs.md
@@ -0,0 +1,13 @@
+
+Mounting docker.sock from the host can give the container full root access to the host.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/spec-volumes-hostpath-path-var-run-docker-sock/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0008/docs.md
new file mode 100644
index 0000000..93126cf
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0008/docs.md
@@ -0,0 +1,13 @@
+
+Sharing the host’s IPC namespace allows container processes to communicate with processes on the host.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0009/docs.md
new file mode 100644
index 0000000..8441977
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0009/docs.md
@@ -0,0 +1,13 @@
+
+Sharing the host’s network namespace permits processes in the pod to communicate with processes bound to the host’s loopback adapter.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0010/docs.md
new file mode 100644
index 0000000..d1542a8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0010/docs.md
@@ -0,0 +1,13 @@
+
+Sharing the host’s PID namespace allows visibility on host processes, potentially leaking information such as environment variables and configuration.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0011/docs.md
new file mode 100644
index 0000000..cd9f0b7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0011/docs.md
@@ -0,0 +1,13 @@
+
+Enforcing CPU limits prevents DoS via resource exhaustion.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0012/docs.md
new file mode 100644
index 0000000..86e5958
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0012/docs.md
@@ -0,0 +1,13 @@
+
+Force the running image to run as a non-root user to ensure least privileges.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0013/docs.md
new file mode 100644
index 0000000..33f2e8c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0013/docs.md
@@ -0,0 +1,13 @@
+
+It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/configuration/overview/#container-images
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0014/docs.md
new file mode 100644
index 0000000..b89b58f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0014/docs.md
@@ -0,0 +1,13 @@
+
+An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0015/docs.md
new file mode 100644
index 0000000..32abec5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0015/docs.md
@@ -0,0 +1,13 @@
+
+When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0016/docs.md
new file mode 100644
index 0000000..bc7e225
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0016/docs.md
@@ -0,0 +1,13 @@
+
+When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-resources-limits-memory/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0017/docs.md
new file mode 100644
index 0000000..fb20005
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0017/docs.md
@@ -0,0 +1,13 @@
+
+Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0018/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0018/docs.md
new file mode 100644
index 0000000..5e57994
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0018/docs.md
@@ -0,0 +1,13 @@
+
+Enforcing memory limits prevents DoS via resource exhaustion.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-resources-limits-memory/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0020/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0020/docs.md
new file mode 100644
index 0000000..114cf9c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0020/docs.md
@@ -0,0 +1,13 @@
+
+Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-runasuser/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0021/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0021/docs.md
new file mode 100644
index 0000000..5c4c384
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0021/docs.md
@@ -0,0 +1,13 @@
+
+Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-runasuser/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0022/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0022/docs.md
new file mode 100644
index 0000000..875a938
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0022/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'Capabilities', capabilities beyond the default set must not be added.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0023/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0023/docs.md
new file mode 100644
index 0000000..61a3fdd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0023/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'HostPath Volumes', HostPath volumes must be forbidden.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0024/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0024/docs.md
new file mode 100644
index 0000000..ac21a2b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0024/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'Host Ports', hostPorts should be disallowed, or at minimum restricted to a known list.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0025/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0025/docs.md
new file mode 100644
index 0000000..f636ebf
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0025/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'SElinux', setting custom SELinux options should be disallowed.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0026/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0026/docs.md
new file mode 100644
index 0000000..41d5c61
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0026/docs.md
@@ -0,0 +1,13 @@
+
+Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0027/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0027/docs.md
new file mode 100644
index 0000000..241f125
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0027/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard '/proc Mount Type', the default /proc masks are set up to reduce attack surface, and should be required.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0028/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0028/docs.md
new file mode 100644
index 0000000..0084225
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0028/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'Volume types', non-core volume types must not be used.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0030/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0030/docs.md
new file mode 100644
index 0000000..10fa332
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0030/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'Seccomp', the RuntimeDefault seccomp profile must be required, or allow specific additional profiles.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0036/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0036/docs.md
new file mode 100644
index 0000000..70945a4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0036/docs.md
@@ -0,0 +1,13 @@
+
+ensure that Pod specifications disable the secret token being mounted by setting automountServiceAccountToken: false
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#serviceaccount-admission-controller
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0037/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0037/docs.md
new file mode 100644
index 0000000..b882c5f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0037/docs.md
@@ -0,0 +1,13 @@
+
+ensure that User pods are not placed in kube-system namespace
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/reference/setup-tools/kubeadm/implementation-details/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0038/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0038/docs.md
new file mode 100644
index 0000000..6c39825
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0038/docs.md
@@ -0,0 +1,13 @@
+
+ensure that network policies selectors are applied to pods or namespaces to restricted ingress and egress traffic within the pod network
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0041/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0041/docs.md
new file mode 100644
index 0000000..7acf6da
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0041/docs.md
@@ -0,0 +1,13 @@
+
+Viewing secrets at the cluster-scope is akin to cluster-admin in most clusters as there are typically at least one service accounts (their token stored in a secret) bound to cluster-admin directly or a role/clusterrole that gives similar permissions.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0042/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0042/docs.md
new file mode 100644
index 0000000..ab6d46c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0042/docs.md
@@ -0,0 +1,13 @@
+
+Used to cover attacker’s tracks, but most clusters ship logs quickly off-cluster.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0043/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0043/docs.md
new file mode 100644
index 0000000..64a0b72
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0043/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits impersonating privileged groups
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0044/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0044/docs.md
new file mode 100644
index 0000000..a1c56b4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0044/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits wildcard verb on wildcard resource
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0045/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0045/docs.md
new file mode 100644
index 0000000..8fe1939
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0045/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits wildcard verb on specific resources
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0046/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0046/docs.md
new file mode 100644
index 0000000..4257a2a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0046/docs.md
@@ -0,0 +1,13 @@
+
+Full control of the cluster resources, and therefore also root on all nodes where workloads can run and has access to all pods, secrets, and data.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0047/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0047/docs.md
new file mode 100644
index 0000000..c41c35c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0047/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits privilege escalation from node proxy
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0048/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0048/docs.md
new file mode 100644
index 0000000..a5b9acd
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0048/docs.md
@@ -0,0 +1,13 @@
+
+Depending on the policies enforced by the admission controller, this permission ranges from the ability to steal compute (crypto) by running workloads or allowing for creating workloads that escape to the node as root and escalation to cluster-admin.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0049/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0049/docs.md
new file mode 100644
index 0000000..36e0dd2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0049/docs.md
@@ -0,0 +1,13 @@
+
+Some workloads leverage configmaps to store sensitive data or configuration parameters that affect runtime behavior that can be modified by an attacker or combined with another issue to potentially lead to compromise.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0050/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0050/docs.md
new file mode 100644
index 0000000..2cef3c2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0050/docs.md
@@ -0,0 +1,13 @@
+
+An effective level of access equivalent to cluster-admin should not be provided.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0051/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0051/docs.md
new file mode 100644
index 0000000..c746354
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0051/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits creating role bindings and associating to privileged role/clusterrole
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0052/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0052/docs.md
new file mode 100644
index 0000000..e98e4c3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0052/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits creating role ClusterRoleBindings and association with privileged cluster role
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0053/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0053/docs.md
new file mode 100644
index 0000000..85e8bc4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0053/docs.md
@@ -0,0 +1,13 @@
+
+The ability to exec into a container with privileged access to the host or with an attached SA with higher RBAC permissions is a common escalation path to cluster-admin.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0054/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0054/docs.md
new file mode 100644
index 0000000..427f885
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0054/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits attaching to shell on pods
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0055/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0055/docs.md
new file mode 100644
index 0000000..5997ca3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0055/docs.md
@@ -0,0 +1,13 @@
+
+Check whether role permits allowing users in a rolebinding to add other users to their rolebindings
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0056/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0056/docs.md
new file mode 100644
index 0000000..6b271c6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0056/docs.md
@@ -0,0 +1,13 @@
+
+The ability to control which pods get service traffic directed to them allows for interception attacks. Controlling network policy allows for bypassing lateral movement restrictions.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-01010/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-01010/docs.md
new file mode 100644
index 0000000..f69f12c
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-01010/docs.md
@@ -0,0 +1,10 @@
+
+Storing sensitive content such as usernames and email addresses in configMaps is unsafe
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0102/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0102/docs.md
new file mode 100644
index 0000000..bda1e20
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0102/docs.md
@@ -0,0 +1,10 @@
+
+Check if Helm Tiller component is deployed.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0103/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0103/docs.md
new file mode 100644
index 0000000..13047dc
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0103/docs.md
@@ -0,0 +1,13 @@
+
+Windows pods offer the ability to run HostProcess containers which enable privileged access to the Windows node.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0104/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0104/docs.md
new file mode 100644
index 0000000..95ee956
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0104/docs.md
@@ -0,0 +1,13 @@
+
+A program inside the container can bypass Seccomp protection policies.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0105/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0105/docs.md
new file mode 100644
index 0000000..ba2deb7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0105/docs.md
@@ -0,0 +1,13 @@
+
+Containers should be forbidden from running with a root UID.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0106/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0106/docs.md
new file mode 100644
index 0000000..f7918c4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0106/docs.md
@@ -0,0 +1,13 @@
+
+Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0107/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0107/docs.md
new file mode 100644
index 0000000..6af76b2
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0107/docs.md
@@ -0,0 +1,13 @@
+
+apiVersion '' and kind '' has been deprecated on: '' and planned for removal on:''
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+-
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0108/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0108/docs.md
new file mode 100644
index 0000000..9c1e772
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0108/docs.md
@@ -0,0 +1,10 @@
+
+Services with external IP addresses allows direct access from the internet and might expose risk for CVE-2020-8554
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0109/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0109/docs.md
new file mode 100644
index 0000000..70bba0f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0109/docs.md
@@ -0,0 +1,10 @@
+
+Storing secrets in configMaps is unsafe
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0110/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0110/docs.md
new file mode 100644
index 0000000..ecd7a45
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0110/docs.md
@@ -0,0 +1,13 @@
+
+Checks whether a workload is running in the default namespace.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0111/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0111/docs.md
new file mode 100644
index 0000000..2504110
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0111/docs.md
@@ -0,0 +1,13 @@
+
+Either cluster-admin or those granted powerful permissions.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0112/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0112/docs.md
new file mode 100644
index 0000000..dac8568
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0112/docs.md
@@ -0,0 +1,13 @@
+
+Full control of the resources within a namespace. In some cluster configurations, this is excessive. In others, this is normal (a gitops deployment operator like flux)
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0113/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0113/docs.md
new file mode 100644
index 0000000..4e6afa6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0113/docs.md
@@ -0,0 +1,13 @@
+
+Viewing secrets at the namespace scope can lead to escalation if another service account in that namespace has a higher privileged rolebinding or clusterrolebinding bound.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0114/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0114/docs.md
new file mode 100644
index 0000000..e5f0d5a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0114/docs.md
@@ -0,0 +1,13 @@
+
+Webhooks can silently intercept or actively mutate/block resources as they are being created or updated. This includes secrets and pod specs.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0115/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0115/docs.md
new file mode 100644
index 0000000..aa50f17
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0115/docs.md
@@ -0,0 +1,13 @@
+
+Ability to add AWS IAM to RBAC bindings via special EKS configmap.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0116/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0116/docs.md
new file mode 100644
index 0000000..ef60ecb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0116/docs.md
@@ -0,0 +1,13 @@
+
+According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubesec.io/basics/containers-securitycontext-runasuser/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0117/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0117/docs.md
new file mode 100644
index 0000000..a563b5b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0117/docs.md
@@ -0,0 +1,13 @@
+
+The ports which are lower than 1024 receive and transmit various sensitive and privileged data. Allowing containers to use them can bring serious implications.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0118/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0118/docs.md
new file mode 100644
index 0000000..1a70c18
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0118/docs.md
@@ -0,0 +1,13 @@
+
+Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0119/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0119/docs.md
new file mode 100644
index 0000000..c0b5b17
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0119/docs.md
@@ -0,0 +1,13 @@
+
+The NET_RAW capability grants attackers the ability to eavesdrop on network traffic or generate IP traffic with falsified source addresses, posing serious security risks.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0120/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0120/docs.md
new file mode 100644
index 0000000..2ab7ed4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0120/docs.md
@@ -0,0 +1,13 @@
+
+The SYS_MODULE capability grants attackers the ability to install and remove kernel modules, posing serious security risks.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0121/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0121/docs.md
new file mode 100644
index 0000000..4959098
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0121/docs.md
@@ -0,0 +1,13 @@
+
+HostPath present many security risks and as a security practice it is better to avoid critical host paths mounts.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0122/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0122/docs.md
new file mode 100644
index 0000000..cf60a5f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/general/AVD-KSV-0122/docs.md
@@ -0,0 +1,13 @@
+
+Binding to anonymous user to any clusterrole or role is a security risk.
+
+### Impact
+
+
+
+{{ remediationActions }}
+
+### Links
+- https://blog.aquasec.com/kubernetes-exposed-one-yaml-away-from-disaster
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/Terraform.md
new file mode 100644
index 0000000..475ca5a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/Terraform.md
@@ -0,0 +1,70 @@
+
+Remove public access except where explicitly required
+
+```hcl
+ resource "kubernetes_network_policy" "good_example" {
+ metadata {
+ name = "terraform-example-network-policy"
+ namespace = "default"
+ }
+
+ spec {
+ pod_selector {
+ match_expressions {
+ key = "name"
+ operator = "In"
+ values = ["webfront", "api"]
+ }
+ }
+
+ ingress {
+ ports {
+ port = "http"
+ protocol = "TCP"
+ }
+ ports {
+ port = "8125"
+ protocol = "UDP"
+ }
+
+ from {
+ ip_block {
+ cidr = "10.0.0.0/16"
+ except = [
+ "10.0.0.0/24",
+ "10.0.1.0/24",
+ ]
+ }
+ }
+ }
+
+ egress {
+ ports {
+ port = "http"
+ protocol = "TCP"
+ }
+ ports {
+ port = "8125"
+ protocol = "UDP"
+ }
+
+ to {
+ ip_block {
+ cidr = "0.0.0.0/0"
+ except = [
+ "10.0.0.0/24",
+ "10.0.1.0/24",
+ ]
+ }
+ }
+ }
+
+ policy_types = ["Ingress", "Egress"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/network_policy#spec.ingress.from.ip_block.cidr
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/docs.md
new file mode 100644
index 0000000..d99ebb9
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0001/docs.md
@@ -0,0 +1,10 @@
+
+You should not expose infrastructure to the public internet except where explicitly required
+
+### Impact
+Exposure of infrastructure to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/Terraform.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/Terraform.md
new file mode 100644
index 0000000..5d4db9e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/Terraform.md
@@ -0,0 +1,70 @@
+
+Remove public access except where explicitly required
+
+```hcl
+ resource "kubernetes_network_policy" "good_example" {
+ metadata {
+ name = "terraform-example-network-policy"
+ namespace = "default"
+ }
+
+ spec {
+ pod_selector {
+ match_expressions {
+ key = "name"
+ operator = "In"
+ values = ["webfront", "api"]
+ }
+ }
+
+ egress {
+ ports {
+ port = "http"
+ protocol = "TCP"
+ }
+ ports {
+ port = "8125"
+ protocol = "UDP"
+ }
+
+ to {
+ ip_block {
+ cidr = "10.0.0.0/16"
+ except = [
+ "10.0.0.0/24",
+ "10.0.1.0/24",
+ ]
+ }
+ }
+ }
+
+ ingress {
+ ports {
+ port = "http"
+ protocol = "TCP"
+ }
+ ports {
+ port = "8125"
+ protocol = "UDP"
+ }
+
+ from {
+ ip_block {
+ cidr = "10.0.0.0/16"
+ except = [
+ "10.0.0.0/24",
+ "10.0.1.0/24",
+ ]
+ }
+ }
+ }
+
+ policy_types = ["Ingress", "Egress"]
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/network_policy#spec.ingress.from.ip_block.cidr
+
diff --git a/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/docs.md
new file mode 100644
index 0000000..53664db
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/kubernetes/network/AVD-KUBE-0002/docs.md
@@ -0,0 +1,10 @@
+
+You should not expose infrastructure to the public internet except where explicitly required
+
+### Impact
+Exfiltration of data to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/Terraform.md
new file mode 100644
index 0000000..3c52cd4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/Terraform.md
@@ -0,0 +1,25 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "nifcloud_security_group_rule" "good_example" {
+ type = "IN"
+ cidr_ip = "10.0.0.0/16"
+ }
+
+```
+```hcl
+resource "nifcloud_security_group_rule" "allow_partner_rsync" {
+ type = "IN"
+ security_group_names = [nifcloud_security_group.….group_name]
+ from_port = 22
+ to_port = 22
+ protocol = "TCP"
+ cidr_ip = "10.0.0.0/16"
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/security_group_rule#cidr_ip
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/docs.md
new file mode 100644
index 0000000..776e9ee
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0001/docs.md
@@ -0,0 +1,15 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+When publishing web applications, use a load balancer instead of publishing directly to instances.
+
+
+### Impact
+Your port exposed to the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/fw/rule_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/Terraform.md
new file mode 100644
index 0000000..27978c7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/Terraform.md
@@ -0,0 +1,14 @@
+
+Add descriptions for all security groups
+
+```hcl
+ resource "nifcloud_security_group" "good_example" {
+ group_name = "http"
+ description = "Allow inbound HTTP traffic"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/security_group#description
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/docs.md
new file mode 100644
index 0000000..c7f7a77
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0002/docs.md
@@ -0,0 +1,15 @@
+
+Security groups should include a description for auditing purposes.
+
+Simplifies auditing, debugging, and managing security groups.
+
+### Impact
+Descriptions provide context for the firewall rule reasons
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/fw/change.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/Terraform.md
new file mode 100644
index 0000000..7775c9d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/Terraform.md
@@ -0,0 +1,18 @@
+
+Add descriptions for all security groups rules
+
+```hcl
+ resource "nifcloud_security_group_rule" "good_example" {
+ type = "IN"
+ description = "HTTP from VPC"
+ from_port = 80
+ to_port = 80
+ protocol = "TCP"
+ cidr_ip = nifcloud_private_lan.main.cidr_block
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/security_group_rule#description
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/docs.md
new file mode 100644
index 0000000..d011baa
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0003/docs.md
@@ -0,0 +1,15 @@
+
+Security group rules should include a description for auditing purposes.
+
+Simplifies auditing, debugging, and managing security groups.
+
+### Impact
+Descriptions provide context for the firewall rule reasons
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/fw/rule_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/Terraform.md
new file mode 100644
index 0000000..4af4dea
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/Terraform.md
@@ -0,0 +1,18 @@
+
+Add security group for all instances
+
+```hcl
+ resource "nifcloud_instance" "good_example" {
+ image_id = data.nifcloud_image.ubuntu.id
+ security_group = nifcloud_security_group.example.group_name
+
+ network_interface {
+ network_id = "net-COMMON_GLOBAL"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/instance#security_group
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/docs.md
new file mode 100644
index 0000000..03104d0
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0004/docs.md
@@ -0,0 +1,13 @@
+
+Need to add a security group to your instance.
+
+### Impact
+A security group controls the traffic that is allowed to reach and leave the resources that it is associated with.
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/server/change_fw.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/Terraform.md
new file mode 100644
index 0000000..c588910
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/Terraform.md
@@ -0,0 +1,18 @@
+
+Use private LAN
+
+```hcl
+ resource "nifcloud_instance" "good_example" {
+ image_id = data.nifcloud_image.ubuntu.id
+ security_group = nifcloud_security_group.example.group_name
+
+ network_interface {
+ network_id = nifcloud_private_lan.main.id
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/instance#network_id
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/docs.md
new file mode 100644
index 0000000..26a9f07
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/computing/AVD-NIF-0005/docs.md
@@ -0,0 +1,13 @@
+
+When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.
+
+### Impact
+The common private network is shared with other users
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/plan.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/dns/AVD-NIF-0007/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/dns/AVD-NIF-0007/docs.md
new file mode 100644
index 0000000..70cde12
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/dns/AVD-NIF-0007/docs.md
@@ -0,0 +1,15 @@
+
+
+Removing verified record of TXT auth the risk that
+If the authentication record remains, anyone can register the zone
+
+### Impact
+Risk of DNS records be used by others
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/guide/dns/zone_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/Terraform.md
new file mode 100644
index 0000000..b8e20c3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/Terraform.md
@@ -0,0 +1,13 @@
+
+Use private LAN
+
+```hcl
+ resource "nifcloud_nas_instance" "good_example" {
+ network_id = nifcloud_private_lan.main.id
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/nas_instance#network_id
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/docs.md
new file mode 100644
index 0000000..26a9f07
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0013/docs.md
@@ -0,0 +1,13 @@
+
+When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.
+
+### Impact
+The common private network is shared with other users
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/plan.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/Terraform.md
new file mode 100644
index 0000000..288a741
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/Terraform.md
@@ -0,0 +1,15 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "nifcloud_nas_security_group" "good_example" {
+ rule {
+ cidr_ip = "10.0.0.0/16"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/nas_security_group#cidr_ip
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/docs.md
new file mode 100644
index 0000000..57f20db
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0014/docs.md
@@ -0,0 +1,13 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+
+### Impact
+Your port exposed to the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/api/nas/AuthorizeNASSecurityGroupIngress.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/Terraform.md
new file mode 100644
index 0000000..984cf29
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/Terraform.md
@@ -0,0 +1,14 @@
+
+Add descriptions for all nas security groups
+
+```hcl
+ resource "nifcloud_nas_security_group" "good_example" {
+ group_name = "app"
+ description = "Allow from app traffic"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/nas_security_group#description
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/docs.md
new file mode 100644
index 0000000..b3f2842
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/nas/AVD-NIF-0015/docs.md
@@ -0,0 +1,15 @@
+
+NAS security groups should include a description for auditing purposes.
+
+Simplifies auditing, debugging, and managing nas security groups.
+
+### Impact
+Descriptions provide context for the firewall rule reasons
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/nas/fw_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/Terraform.md
new file mode 100644
index 0000000..f664399
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/Terraform.md
@@ -0,0 +1,17 @@
+
+Add security group for all routers
+
+```hcl
+ resource "nifcloud_router" "good_example" {
+ security_group = nifcloud_security_group.example.group_name
+
+ network_interface {
+ network_id = "net-COMMON_GLOBAL"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/router#security_group
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/docs.md
new file mode 100644
index 0000000..feea9c8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0016/docs.md
@@ -0,0 +1,13 @@
+
+Need to add a security group to your router.
+
+### Impact
+A security group controls the traffic that is allowed to reach and leave the resources that it is associated with.
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/router/change.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/Terraform.md
new file mode 100644
index 0000000..21b00d4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/Terraform.md
@@ -0,0 +1,17 @@
+
+Use private LAN
+
+```hcl
+ resource "nifcloud_router" "good_example" {
+ security_group = nifcloud_security_group.example.group_name
+
+ network_interface {
+ network_id = nifcloud_private_lan.main.id
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/router#network_id
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/docs.md
new file mode 100644
index 0000000..26a9f07
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0017/docs.md
@@ -0,0 +1,13 @@
+
+When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.
+
+### Impact
+The common private network is shared with other users
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/plan.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/Terraform.md
new file mode 100644
index 0000000..89aa23e
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/Terraform.md
@@ -0,0 +1,17 @@
+
+Add security group for all vpnGateways
+
+```hcl
+ resource "nifcloud_vpn_gateway" "good_example" {
+ security_group = nifcloud_security_group.example.group_name
+
+ network_interface {
+ network_id = "net-COMMON_GLOBAL"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/vpn_gateway#security_group
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/docs.md
new file mode 100644
index 0000000..fb87982
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0018/docs.md
@@ -0,0 +1,13 @@
+
+Need to add a security group to your vpnGateway.
+
+### Impact
+A security group controls the traffic that is allowed to reach and leave the resources that it is associated with.
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/vpngw/change.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/Terraform.md
new file mode 100644
index 0000000..a591aeb
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/Terraform.md
@@ -0,0 +1,21 @@
+
+Use private LAN
+
+```hcl
+ resource "nifcloud_elb" "good_example" {
+ elb_name = "foobar"
+ availability_zone = "east-11"
+ instance_port = 80
+ protocol = "HTTP"
+ lb_port = 80
+
+ network_interface {
+ network_id = nifcloud_private_lan.main.id
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/elb#network_id
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/docs.md
new file mode 100644
index 0000000..26a9f07
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0019/docs.md
@@ -0,0 +1,13 @@
+
+When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.
+
+### Impact
+The common private network is shared with other users
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/plan.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/Terraform.md
new file mode 100644
index 0000000..f799d80
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/Terraform.md
@@ -0,0 +1,17 @@
+
+Use a more recent TLS/SSL policy for the load balancer
+
+```hcl
+ resource "nifcloud_load_balancer" "good_example" {
+ load_balancer_port = 443
+ policy_type = "standard"
+ ssl_policy_name = "Standard Ciphers D ver1"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/load_balancer#ssl_policy_name
+
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/load_balancer_listener#ssl_policy_name
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/docs.md
new file mode 100644
index 0000000..9587778
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0020/docs.md
@@ -0,0 +1,13 @@
+
+You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
+
+### Impact
+The SSL policy is outdated and has known vulnerabilities
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/lb_l4.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/Terraform.md
new file mode 100644
index 0000000..51396f3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/Terraform.md
@@ -0,0 +1,21 @@
+
+Switch to HTTPS to benefit from TLS security features
+
+```hcl
+ resource "nifcloud_elb" "good_example" {
+ protocol = "HTTPS"
+ }
+
+```
+```hcl
+resource "nifcloud_load_balancer" "good_example" {
+ load_balancer_port = 443
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/elb#protocol
+
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/load_balancer#load_balancer_port
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/docs.md
new file mode 100644
index 0000000..b5ec5a8
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/network/AVD-NIF-0021/docs.md
@@ -0,0 +1,15 @@
+
+Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth.
+
+You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.
+
+### Impact
+Your traffic is not protected
+
+
+{{ remediationActions }}
+
+### Links
+- https://www.cloudflare.com/en-gb/learning/ssl/why-is-http-not-secure/
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/Terraform.md
new file mode 100644
index 0000000..0d5dc6b
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/Terraform.md
@@ -0,0 +1,13 @@
+
+Set the database to not be publicly accessible
+
+```hcl
+ resource "nifcloud_db_instance" "good_example" {
+ publicly_accessible = false
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_instance#publicly_accessible
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/docs.md
new file mode 100644
index 0000000..ca4bd82
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0008/docs.md
@@ -0,0 +1,13 @@
+
+Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.
+
+### Impact
+The database instance is publicly accessible
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/guide/rdb/server_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/Terraform.md
new file mode 100644
index 0000000..6d8a8aa
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/Terraform.md
@@ -0,0 +1,22 @@
+
+Explicitly set the retention period to greater than the default
+
+```hcl
+ resource "nifcloud_db_instance" "good_example" {
+ allocated_storage = 100
+ engine = "mysql"
+ engine_version = "5.7"
+ instance_class = "db.large8"
+ name = "mydb"
+ username = "foo"
+ password = "foobarbaz"
+ parameter_group_name = "default.mysql5.7"
+ backup_retention_period = 5
+ skip_final_snapshot = true
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_instance#backup_retention_period
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/docs.md
new file mode 100644
index 0000000..0235817
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0009/docs.md
@@ -0,0 +1,13 @@
+
+Backup retention periods should be set to a period that is a balance on cost and limiting risk.
+
+### Impact
+Potential loss of data and short opportunity for recovery
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/spec/rdb/snapshot_backup.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/Terraform.md
new file mode 100644
index 0000000..2286334
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/Terraform.md
@@ -0,0 +1,13 @@
+
+Use private LAN
+
+```hcl
+ resource "nifcloud_db_instance" "good_example" {
+ network_id = nifcloud_private_lan.main.id
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_instance#network_id
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/docs.md
new file mode 100644
index 0000000..26a9f07
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0010/docs.md
@@ -0,0 +1,13 @@
+
+When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.
+
+### Impact
+The common private network is shared with other users
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/service/plan.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/Terraform.md
new file mode 100644
index 0000000..ee60f95
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/Terraform.md
@@ -0,0 +1,15 @@
+
+Set a more restrictive cidr range
+
+```hcl
+ resource "nifcloud_db_security_group" "good_example" {
+ rule {
+ cidr_ip = "10.0.0.0/16"
+ }
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_security_group#cidr_ip
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/docs.md
new file mode 100644
index 0000000..c3fbcd7
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0011/docs.md
@@ -0,0 +1,13 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+
+### Impact
+Your port exposed to the internet
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/api/rdb/AuthorizeDBSecurityGroupIngress.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/Terraform.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/Terraform.md
new file mode 100644
index 0000000..490c742
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/Terraform.md
@@ -0,0 +1,14 @@
+
+Add descriptions for all db security groups
+
+```hcl
+ resource "nifcloud_db_security_group" "good_example" {
+ group_name = "app"
+ description = "Allow from app traffic"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_security_group#description
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/docs.md
new file mode 100644
index 0000000..2531a25
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/rdb/AVD-NIF-0012/docs.md
@@ -0,0 +1,15 @@
+
+DB security groups should include a description for auditing purposes.
+
+Simplifies auditing, debugging, and managing db security groups.
+
+### Impact
+Descriptions provide context for the firewall rule reasons
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/rdb/fw_new.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/nifcloud/sslcertificate/AVD-NIF-0006/docs.md b/cmd/trivy-policies-generator/avd_docs/nifcloud/sslcertificate/AVD-NIF-0006/docs.md
new file mode 100644
index 0000000..f450bb5
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/nifcloud/sslcertificate/AVD-NIF-0006/docs.md
@@ -0,0 +1,18 @@
+
+
+Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be
+deployed accidentally to a resource such as NIFCLOUD Load Balancer(L4LB), which candamage the
+credibility of the application/website behind the L4LB. As a best practice, it is
+recommended to delete expired certificates.
+
+
+### Impact
+Risk of misconfiguration and damage to credibility
+
+
+{{ remediationActions }}
+
+### Links
+- https://pfs.nifcloud.com/help/ssl/del.htm
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/Terraform.md
new file mode 100644
index 0000000..b0b1a64
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/Terraform.md
@@ -0,0 +1,21 @@
+
+Do not use plaintext passwords in terraform files
+
+```hcl
+ resource "openstack_compute_instance_v2" "good_example" {
+ name = "basic"
+ image_id = "ad091b52-742f-469e-8f3c-fd81cadf0743"
+ flavor_id = "3"
+ key_pair = "my_key_pair_name"
+ security_groups = ["default"]
+ user_data = "#cloud-config\nhostname: instance_1.example.com\nfqdn: instance_1.example.com"
+
+ network {
+ name = "my_network"
+ }
+ }
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/compute_instance_v2#admin_pass
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/docs.md
new file mode 100644
index 0000000..f60c9e3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0001/docs.md
@@ -0,0 +1,10 @@
+
+Assigning a password to the compute instance using plaintext could lead to compromise; it would be preferable to use key-pairs as a login mechanism
+
+### Impact
+Including a plaintext password could lead to compromised instance
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/Terraform.md b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/Terraform.md
new file mode 100644
index 0000000..a5904f3
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/Terraform.md
@@ -0,0 +1,20 @@
+
+Employ more restrictive firewall rules
+
+```hcl
+ resource "openstack_fw_rule_v1" "rule_1" {
+ name = "my_rule"
+ description = "don't let just anyone in"
+ action = "allow"
+ protocol = "tcp"
+ destination_ip_address = "10.10.10.1"
+ source_ip_address = "10.10.10.2"
+ destination_port = "22"
+ enabled = "true"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/fw_rule_v1
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/docs.md b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/docs.md
new file mode 100644
index 0000000..b58677a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/compute/AVD-OPNSTK-0002/docs.md
@@ -0,0 +1,10 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+
+### Impact
+Exposure of infrastructure to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/Terraform.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/Terraform.md
new file mode 100644
index 0000000..387a6ed
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/Terraform.md
@@ -0,0 +1,18 @@
+
+Employ more restrictive security group rules
+
+```hcl
+ resource "openstack_networking_secgroup_rule_v2" "rule_1" {
+ direction = "ingress"
+ ethertype = "IPv4"
+ protocol = "tcp"
+ port_range_min = 22
+ port_range_max = 22
+ remote_ip_prefix = "1.2.3.4/32"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/fw_rule_v1
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/docs.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/docs.md
new file mode 100644
index 0000000..b58677a
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0003/docs.md
@@ -0,0 +1,10 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+
+### Impact
+Exposure of infrastructure to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/Terraform.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/Terraform.md
new file mode 100644
index 0000000..3bd7dd6
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/Terraform.md
@@ -0,0 +1,18 @@
+
+Employ more restrictive security group rules
+
+```hcl
+resource "openstack_networking_secgroup_rule_v2" "rule_1" {
+ direction = "egress"
+ ethertype = "IPv4"
+ protocol = "tcp"
+ port_range_min = 22
+ port_range_max = 22
+ remote_ip_prefix = "1.2.3.4/32"
+}
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_secgroup_rule_v2
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/docs.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/docs.md
new file mode 100644
index 0000000..fc7f285
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0004/docs.md
@@ -0,0 +1,10 @@
+
+Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.
+
+### Impact
+Potential exfiltration of data to the public internet
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/Terraform.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/Terraform.md
new file mode 100644
index 0000000..9bfe44d
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/Terraform.md
@@ -0,0 +1,11 @@
+
+Add descriptions for all security groups
+
+```hcl
+ resource "openstack_networking_secgroup_v2" "group_1" {
+ description = "don't let just anyone in"
+ }
+
+```
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/docs.md b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/docs.md
new file mode 100644
index 0000000..656227f
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/openstack/networking/AVD-OPNSTK-0005/docs.md
@@ -0,0 +1,10 @@
+
+Security groups should include a description for auditing purposes. Simplifies auditing, debugging, and managing security groups.
+
+### Impact
+Auditing capability and awareness limited.
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/Terraform.md b/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/Terraform.md
new file mode 100644
index 0000000..51f21d4
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/Terraform.md
@@ -0,0 +1,16 @@
+
+Reconsider the use of an public IP
+
+```hcl
+ resource "opc_compute_ip_address_reservation" "good_example" {
+ name = "my-ip-address"
+ ip_address_pool = "cloud-ippool"
+ }
+
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_ip_address_reservation
+
+ - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_instance
+
diff --git a/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/docs.md b/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/docs.md
new file mode 100644
index 0000000..da43796
--- /dev/null
+++ b/cmd/trivy-policies-generator/avd_docs/oracle/compute/AVD-OCI-0001/docs.md
@@ -0,0 +1,12 @@
+
+Compute instance requests an IP reservation from a public pool
+
+The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
+
+### Impact
+The compute instance has the ability to be reached from outside
+
+
+{{ remediationActions }}
+
+
diff --git a/cmd/trivy-policies-generator/go.mod b/cmd/trivy-policies-generator/go.mod
new file mode 100644
index 0000000..4a4f6f7
--- /dev/null
+++ b/cmd/trivy-policies-generator/go.mod
@@ -0,0 +1,80 @@
+module github.com/aquasecurity/avd-generator/trivy-policies-generator
+
+go 1.21.4
+
+require (
+ github.com/aquasecurity/defsec v0.93.2-0.20231121210951-9b3cc255faff
+ github.com/aquasecurity/trivy-policies v0.7.0
+ github.com/stretchr/testify v1.8.4
+)
+
+require (
+ dario.cat/mergo v1.0.0 // indirect
+ github.com/Microsoft/go-winio v0.6.1 // indirect
+ github.com/OneOfOne/xxhash v1.2.8 // indirect
+ github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+ github.com/acomagu/bufpipe v1.0.4 // indirect
+ github.com/agext/levenshtein v1.2.3 // indirect
+ github.com/agnivade/levenshtein v1.1.1 // indirect
+ github.com/alecthomas/chroma v0.10.0 // indirect
+ github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+ github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+ github.com/beorn7/perks v1.0.1 // indirect
+ github.com/cespare/xxhash/v2 v2.2.0 // indirect
+ github.com/cloudflare/circl v1.3.3 // indirect
+ github.com/davecgh/go-spew v1.1.1 // indirect
+ github.com/dlclark/regexp2 v1.4.0 // indirect
+ github.com/emirpasic/gods v1.18.1 // indirect
+ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+ github.com/go-git/go-billy/v5 v5.4.1 // indirect
+ github.com/go-git/go-git/v5 v5.8.1 // indirect
+ github.com/go-ini/ini v1.67.0 // indirect
+ github.com/go-logr/logr v1.2.4 // indirect
+ github.com/go-logr/stdr v1.2.2 // indirect
+ github.com/gobwas/glob v0.2.3 // indirect
+ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+ github.com/golang/protobuf v1.5.3 // indirect
+ github.com/google/uuid v1.3.1 // indirect
+ github.com/gorilla/mux v1.8.0 // indirect
+ github.com/hashicorp/hcl/v2 v2.18.1 // indirect
+ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+ github.com/kevinburke/ssh_config v1.2.0 // indirect
+ github.com/liamg/iamgo v0.0.9 // indirect
+ github.com/liamg/jfather v0.0.7 // indirect
+ github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+ github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+ github.com/mitchellh/mapstructure v1.5.0 // indirect
+ github.com/open-policy-agent/opa v0.58.0 // indirect
+ github.com/owenrumney/squealer v1.2.1 // indirect
+ github.com/pjbgf/sha1cd v0.3.0 // indirect
+ github.com/pmezard/go-difflib v1.0.0 // indirect
+ github.com/prometheus/client_golang v1.16.0 // indirect
+ github.com/prometheus/client_model v0.4.0 // indirect
+ github.com/prometheus/common v0.44.0 // indirect
+ github.com/prometheus/procfs v0.10.1 // indirect
+ github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+ github.com/sergi/go-diff v1.2.0 // indirect
+ github.com/sirupsen/logrus v1.9.3 // indirect
+ github.com/skeema/knownhosts v1.2.0 // indirect
+ github.com/tchap/go-patricia/v2 v2.3.1 // indirect
+ github.com/xanzy/ssh-agent v0.3.3 // indirect
+ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+ github.com/yashtewari/glob-intersection v0.2.0 // indirect
+ github.com/zclconf/go-cty v1.13.0 // indirect
+ go.opentelemetry.io/otel v1.19.0 // indirect
+ go.opentelemetry.io/otel/metric v1.19.0 // indirect
+ go.opentelemetry.io/otel/sdk v1.19.0 // indirect
+ go.opentelemetry.io/otel/trace v1.19.0 // indirect
+ golang.org/x/crypto v0.14.0 // indirect
+ golang.org/x/mod v0.13.0 // indirect
+ golang.org/x/net v0.17.0 // indirect
+ golang.org/x/sys v0.13.0 // indirect
+ golang.org/x/text v0.13.0 // indirect
+ golang.org/x/tools v0.13.0 // indirect
+ google.golang.org/protobuf v1.31.0 // indirect
+ gopkg.in/warnings.v0 v0.1.2 // indirect
+ gopkg.in/yaml.v2 v2.4.0 // indirect
+ gopkg.in/yaml.v3 v3.0.1 // indirect
+ sigs.k8s.io/yaml v1.4.0 // indirect
+)
diff --git a/cmd/trivy-policies-generator/go.sum b/cmd/trivy-policies-generator/go.sum
new file mode 100644
index 0000000..367539f
--- /dev/null
+++ b/cmd/trivy-policies-generator/go.sum
@@ -0,0 +1,304 @@
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
+github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
+github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
+github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
+github.com/alecthomas/chroma v0.10.0/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
+github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/aquasecurity/defsec v0.93.2-0.20231121210951-9b3cc255faff h1:P9ISna6RaiMyoxDcROR4v68/OGnnrGC1AE60l/c6Y8M=
+github.com/aquasecurity/defsec v0.93.2-0.20231121210951-9b3cc255faff/go.mod h1:djPPxDAf6seSulvNiZn7jelIddA9wdWRvfWarso3U3c=
+github.com/aquasecurity/trivy-policies v0.7.0 h1:a5K3kTQMWQhUWnRxEahosJFcz32dxVq0eLs31vcEwEQ=
+github.com/aquasecurity/trivy-policies v0.7.0/go.mod h1:47Eua7lLyrsS3agGxBhgeUV8/a/LN82bqYoHm9oEGm4=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
+github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
+github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
+github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dlclark/regexp2 v1.4.0 h1:F1rxgk7p4uKjwIQxBs9oAXe5CqrXlCduYEJvrF4u93E=
+github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
+github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819 h1:RIB4cRk+lBqKK3Oy0r2gRX4ui7tuhiZq2SuTtTCi0/0=
+github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
+github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
+github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
+github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
+github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
+github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f h1:Pz0DHeFij3XFhoBRGUDPzSJ+w2UcK5/0JvF8DRI58r8=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f/go.mod h1:8LHG1a3SRW71ettAD/jW13h8c6AqjVSeL11RAdgaqpo=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
+github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/flatbuffers v1.12.1 h1:MVlul7pQNoDzWRLTw5imwYsl+usrS1TXG2H4jg6ImGw=
+github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/hashicorp/hcl/v2 v2.18.1 h1:6nxnOJFku1EuSawSD81fuviYUV8DxFr3fp2dUi3ZYSo=
+github.com/hashicorp/hcl/v2 v2.18.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/klauspost/compress v1.16.6 h1:91SKEy4K37vkp255cJ8QesJhjyRO0hn9i9G0GoUwLsk=
+github.com/klauspost/compress v1.16.6/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/liamg/iamgo v0.0.9 h1:tADGm3xVotyRJmuKKaH4+zsBn7LOcvgdpuF3WsSKW3c=
+github.com/liamg/iamgo v0.0.9/go.mod h1:Kk6ZxBF/GQqG9nnaUjIi6jf+WXNpeOTyhwc6gnguaZQ=
+github.com/liamg/jfather v0.0.7 h1:Xf78zS263yfT+xr2VSo6+kyAy4ROlCacRqJG7s5jt4k=
+github.com/liamg/jfather v0.0.7/go.mod h1:xXBGiBoiZ6tmHhfy5Jzw8sugzajwYdi6VosIpB3/cPM=
+github.com/liamg/memoryfs v1.6.0 h1:jAFec2HI1PgMTem5gR7UT8zi9u4BfG5jorCRlLH06W8=
+github.com/liamg/memoryfs v1.6.0/go.mod h1:z7mfqXFQS8eSeBBsFjYLlxYRMRyiPktytvYCYTb3BSk=
+github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
+github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
+github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/open-policy-agent/opa v0.58.0 h1:S5qvevW8JoFizU7Hp66R/Y1SOXol0aCdFYVkzIqIpUo=
+github.com/open-policy-agent/opa v0.58.0/go.mod h1:EGWBwvmyt50YURNvL8X4W5hXdlKeNhAHn3QXsetmYcc=
+github.com/owenrumney/squealer v1.2.1 h1:4ryMMT59aaz8VMsqsD+FDkarADJz0F1dcq2fd0DRR+c=
+github.com/owenrumney/squealer v1.2.1/go.mod h1:7D0a/+Bouwy504YhaWsBYW73kyklSEq1MNf6zsNoTRg=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
+github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
+github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
+github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
+github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
+github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
+github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.13.0 h1:It5dfKTTZHe9aeppbNOda3mN7Ag7sg6QkBNm6TkyFa0=
+github.com/zclconf/go-cty v1.13.0/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
+go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
+go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
+go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
+go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
+go.opentelemetry.io/otel/sdk v1.19.0 h1:6USY6zH+L8uMH8L3t1enZPR3WFEmSTADlqldyHtJi3o=
+go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
+go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
+go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d h1:DoPTO70H+bcDXcd39vOqb2viZxgqeBeSGtZ55yZU4/Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/cmd/trivy-policies-generator/main.go b/cmd/trivy-policies-generator/main.go
new file mode 100644
index 0000000..1f1ab86
--- /dev/null
+++ b/cmd/trivy-policies-generator/main.go
@@ -0,0 +1,194 @@
+package main
+
+import (
+ "fmt"
+ goast "go/ast"
+ "go/parser"
+ "go/token"
+ "io"
+ "os"
+ "path/filepath"
+ "strings"
+ "text/template"
+
+ "github.com/aquasecurity/defsec/pkg/framework"
+ "github.com/aquasecurity/trivy-policies/rules"
+
+ _ "github.com/aquasecurity/defsec/pkg/rego"
+ registered "github.com/aquasecurity/defsec/pkg/rules"
+ drules "github.com/aquasecurity/defsec/pkg/types/rules"
+)
+
+func main() {
+ var generateCount int
+
+ for _, metadata := range registered.GetRegistered(framework.ALL) {
+ writeDocsFile(metadata, "avd_docs")
+ generateCount++
+ }
+
+ fmt.Printf("\nGenerated %d files in avd_docs\n", generateCount)
+}
+
+// nolint: cyclop
+func writeDocsFile(meta drules.RegisteredRule, path string) {
+
+ tmpl, err := template.New("defsec").Parse(docsMarkdownTemplate)
+ if err != nil {
+ fail("error occurred creating the template %v\n", err)
+ }
+
+ docpath := filepath.Join(path,
+ strings.ToLower(meta.GetRule().Provider.ConstName()),
+ strings.ToLower(strings.ReplaceAll(meta.GetRule().Service, "-", "")),
+ meta.GetRule().AVDID,
+ )
+
+ if err := os.MkdirAll(docpath, os.ModePerm); err != nil {
+ panic(err)
+ }
+
+ file, err := os.Create(filepath.Join(docpath, "docs.md"))
+ if err != nil {
+ fail("error occurred creating the docs file for %s", docpath)
+ }
+
+ if err := tmpl.Execute(file, meta.GetRule()); err != nil {
+ fail("error occurred generating the document %v", err)
+ }
+ fmt.Printf("Generating docs file for policy %s\n", meta.GetRule().AVDID)
+
+ if meta.GetRule().Terraform != nil {
+ if len(meta.GetRule().Terraform.GoodExamples) > 0 || len(meta.GetRule().Terraform.Links) > 0 {
+ if meta.GetRule().RegoPackage != "" { // get examples from file as rego rules don't have embedded
+ value, err := GetExampleValueFromFile(meta.GetRule().Terraform.GoodExamples[0], "GoodExamples")
+ if err != nil {
+ fail("error retrieving examples from metadata: %v\n", err)
+ }
+ meta.GetRule().Terraform.GoodExamples = []string{value}
+ }
+
+ tmpl, err := template.New("terraform").Parse(terraformMarkdownTemplate)
+ if err != nil {
+ fail("error occurred creating the template %v\n", err)
+ }
+ file, err := os.Create(filepath.Join(docpath, "Terraform.md"))
+ if err != nil {
+ fail("error occurred creating the Terraform file for %s", docpath)
+ }
+ defer func() { _ = file.Close() }()
+
+ if err := tmpl.Execute(file, meta.GetRule()); err != nil {
+ fail("error occurred generating the document %v", err)
+ }
+ fmt.Printf("Generating Terraform file for policy %s\n", meta.GetRule().AVDID)
+ }
+ }
+
+ if meta.GetRule().CloudFormation != nil {
+ if len(meta.GetRule().CloudFormation.GoodExamples) > 0 || len(meta.GetRule().CloudFormation.Links) > 0 {
+ if meta.GetRule().RegoPackage != "" { // get examples from file as rego rules don't have embedded
+ value, err := GetExampleValueFromFile(meta.GetRule().CloudFormation.GoodExamples[0], "GoodExamples")
+ if err != nil {
+ fail("error retrieving examples from metadata: %v\n", err)
+ }
+ meta.GetRule().CloudFormation.GoodExamples = []string{value}
+ }
+
+ tmpl, err := template.New("cloudformation").Parse(cloudformationMarkdownTemplate)
+ if err != nil {
+ fail("error occurred creating the template %v\n", err)
+ }
+ file, err := os.Create(filepath.Join(docpath, "CloudFormation.md"))
+ if err != nil {
+ fail("error occurred creating the CloudFormation file for %s", docpath)
+ }
+ defer func() { _ = file.Close() }()
+
+ if err := tmpl.Execute(file, meta.GetRule()); err != nil {
+ fail("error occurred generating the document %v", err)
+ }
+ fmt.Printf("Generating CloudFormation file for policy %s\n", meta.GetRule().AVDID)
+ }
+ }
+}
+
+func fail(msg string, args ...interface{}) {
+ fmt.Printf(msg, args...)
+ os.Exit(1)
+}
+
+func readFileFromPolicyFS(path string) (io.Reader, error) {
+ path = strings.TrimPrefix(path, "rules/")
+ return rules.EmbeddedPolicyFileSystem.Open(path)
+
+}
+
+func GetExampleValueFromFile(filename string, exampleType string) (string, error) {
+ r, err := readFileFromPolicyFS(filename)
+ if err != nil {
+ return "", err
+ }
+ f, err := parser.ParseFile(token.NewFileSet(), filename, r, parser.AllErrors)
+ if err != nil {
+ return "", err
+ }
+
+ for _, d := range f.Decls {
+ switch decl := d.(type) {
+ case *goast.GenDecl:
+ for _, spec := range decl.Specs {
+ switch spec := spec.(type) {
+ case *goast.ValueSpec:
+ for _, id := range spec.Names {
+ switch v := id.Obj.Decl.(*goast.ValueSpec).Values[0].(type) {
+ case *goast.CompositeLit:
+ value := v.Elts[0].(*goast.BasicLit).Value
+ if strings.Contains(id.Name, exampleType) {
+ return strings.ReplaceAll(value, "`", ""), nil
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ return "", fmt.Errorf("exampleType %s not found in file: %s", exampleType, filename)
+}
+
+var docsMarkdownTemplate = `
+{{ .Explanation }}
+
+### Impact
+{{ if .Impact }}{{ .Impact }}{{ else }}{{ end }}
+
+
+{{ ` + "`{{ " + `remediationActions ` + "`}}" + `}}
+
+{{ if .Links }}### Links{{ range .Links }}
+- {{ . }}
+{{ end}}
+{{ end }}
+`
+
+var terraformMarkdownTemplate = `
+{{ .Resolution }}
+
+{{ if .Terraform.GoodExamples }}{{ range .Terraform.GoodExamples }}` + "```hcl" + `{{ . }}
+` + "```" + `
+{{ end}}{{ end }}
+{{ if .Terraform.Links }}#### Remediation Links{{ range .Terraform.Links }}
+ - {{ . }}
+{{ end}}{{ end }}
+`
+
+var cloudformationMarkdownTemplate = `
+{{ .Resolution }}
+
+{{ if .CloudFormation.GoodExamples }}{{ range .CloudFormation.GoodExamples }}` + "```yaml" + `{{ . }}
+` + "```" + `
+{{ end}}{{ end }}
+{{ if .CloudFormation.Links }}#### Remediation Links{{ range .CloudFormation.Links }}
+ - {{ . }}
+{{ end}}{{ end }}
+`
diff --git a/cmd/trivy-policies-generator/main_test.go b/cmd/trivy-policies-generator/main_test.go
new file mode 100644
index 0000000..545bbca
--- /dev/null
+++ b/cmd/trivy-policies-generator/main_test.go
@@ -0,0 +1,86 @@
+package main
+
+import (
+ "fmt"
+ "os"
+ "path"
+ "path/filepath"
+ "runtime"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+
+ "github.com/aquasecurity/defsec/pkg/framework"
+ registered "github.com/aquasecurity/defsec/pkg/rules"
+)
+
+func init() { // change the pwd for the test to top level defesc dir
+ _, filename, _, _ := runtime.Caller(0)
+ dir := path.Join(path.Dir(filename), "../..")
+ err := os.Chdir(dir)
+ if err != nil {
+ panic(err)
+ }
+}
+
+func Test_AVDPageGeneration(t *testing.T) {
+ tmpDir := t.TempDir()
+ defer func() {
+ os.RemoveAll(tmpDir)
+ }()
+
+ var generateCount int
+ for _, metadata := range registered.GetRegistered(framework.ALL) {
+ writeDocsFile(metadata, tmpDir)
+ generateCount++
+ }
+ fmt.Printf("\nGenerated %d files in avd_docs\n", generateCount)
+
+ // check golang policies
+ b, err := os.ReadFile(filepath.Join(tmpDir, "aws/rds/AVD-AWS-0077", "Terraform.md"))
+ require.NoError(t, err)
+ assert.Contains(t, string(b), `hcl
+ resource "aws_rds_cluster" "good_example" {
+ cluster_identifier = "aurora-cluster-demo"
+ engine = "aurora-mysql"
+ engine_version = "5.7.mysql_aurora.2.03.2"
+ availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
+ database_name = "mydb"
+ master_username = "foo"
+ master_password = "bar"
+ backup_retention_period = 5
+ preferred_backup_window = "07:00-09:00"
+ }`)
+
+ b, err = os.ReadFile(filepath.Join(tmpDir, "aws/rds/AVD-AWS-0077", "CloudFormation.md"))
+ require.NoError(t, err)
+ assert.Contains(t, string(b), `yaml---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Good example
+Resources:
+ Queue:
+ Type: AWS::RDS::DBInstance
+ Properties:
+ BackupRetentionPeriod: 30
+`)
+
+ // check rego policies
+ b, err = os.ReadFile(filepath.Join(tmpDir, "aws/rds/AVD-AWS-0180", "Terraform.md"))
+ require.NoError(t, err)
+ assert.Contains(t, string(b), `hcl
+ resource "aws_db_instance" "good_example" {
+ publicly_accessible = false
+ }`)
+
+ b, err = os.ReadFile(filepath.Join(tmpDir, "aws/rds/AVD-AWS-0180", "CloudFormation.md"))
+ require.NoError(t, err)
+ assert.Contains(t, string(b), `yaml---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Good example
+Resources:
+ Queue:
+ Type: AWS::RDS::DBInstance
+ Properties:
+ PubliclyAccessible: false`)
+}
diff --git a/docGen/main.go b/docGen/main.go
index 49cc533..dfc2b9e 100644
--- a/docGen/main.go
+++ b/docGen/main.go
@@ -42,11 +42,11 @@ func main() {
generateChainBenchPages("../avd-repo/chain-bench-repo/internal/checks", "../avd-repo/content/compliance")
generateKubeBenchPages("../avd-repo/kube-bench-repo/cfg", "../avd-repo/content/compliance")
- generateDefsecComplianceSpecPages("../avd-repo/trivy-policies-repo/rules/specs/compliance", "../avd-repo/content/compliance")
+ generateDefsecComplianceSpecPages("../avd-repo/trivy-policies-repo/specs/compliance", "../avd-repo/content/compliance")
generateKubeHunterPages("../avd-repo/kube-hunter-repo/docs/_kb", "../avd-repo/content/misconfig/kubernetes")
generateCloudSploitPages("../avd-repo/cloudsploit-repo/plugins", "../avd-repo/content/misconfig", "../avd-repo/remediations-repo/en")
generateTraceePages("../avd-repo/tracee-repo/signatures", "../avd-repo/content/tracee", realClock{})
- generateDefsecPages("../avd-repo/trivy-policies-repo/avd_docs", "../avd-repo/content/misconfig")
+ generateDefsecPages("../cmd/trivy-policies-generator/avd_docs", "../avd-repo/content/misconfig")
generateVulnPages()
diff --git a/test/go.mod b/test/go.mod
new file mode 100644
index 0000000..17b74cd
--- /dev/null
+++ b/test/go.mod
@@ -0,0 +1,52 @@
+module github.com/aquasecurity/avd-generator/test
+
+go 1.21.4
+
+require (
+ github.com/aquasecurity/defsec v0.93.2-0.20231201010509-455085f613e1
+ github.com/stretchr/testify v1.8.4
+)
+
+require (
+ dario.cat/mergo v1.0.0 // indirect
+ github.com/Microsoft/go-winio v0.6.1 // indirect
+ github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+ github.com/acomagu/bufpipe v1.0.4 // indirect
+ github.com/agext/levenshtein v1.2.3 // indirect
+ github.com/alecthomas/chroma v0.10.0 // indirect
+ github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+ github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+ github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842 // indirect
+ github.com/cloudflare/circl v1.3.3 // indirect
+ github.com/davecgh/go-spew v1.1.1 // indirect
+ github.com/dlclark/regexp2 v1.4.0 // indirect
+ github.com/emirpasic/gods v1.18.1 // indirect
+ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+ github.com/go-git/go-billy/v5 v5.4.1 // indirect
+ github.com/go-git/go-git/v5 v5.8.1 // indirect
+ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+ github.com/google/uuid v1.4.0 // indirect
+ github.com/hashicorp/hcl/v2 v2.19.1 // indirect
+ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+ github.com/kevinburke/ssh_config v1.2.0 // indirect
+ github.com/liamg/iamgo v0.0.9 // indirect
+ github.com/liamg/jfather v0.0.7 // indirect
+ github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+ github.com/owenrumney/squealer v1.2.1 // indirect
+ github.com/pjbgf/sha1cd v0.3.0 // indirect
+ github.com/pmezard/go-difflib v1.0.0 // indirect
+ github.com/sergi/go-diff v1.1.0 // indirect
+ github.com/sirupsen/logrus v1.9.3 // indirect
+ github.com/skeema/knownhosts v1.2.0 // indirect
+ github.com/xanzy/ssh-agent v0.3.3 // indirect
+ github.com/zclconf/go-cty v1.13.0 // indirect
+ golang.org/x/crypto v0.14.0 // indirect
+ golang.org/x/mod v0.10.0 // indirect
+ golang.org/x/net v0.17.0 // indirect
+ golang.org/x/sys v0.13.0 // indirect
+ golang.org/x/text v0.14.0 // indirect
+ golang.org/x/tools v0.8.0 // indirect
+ gopkg.in/warnings.v0 v0.1.2 // indirect
+ gopkg.in/yaml.v2 v2.4.0 // indirect
+ gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/test/go.sum b/test/go.sum
new file mode 100644
index 0000000..31981da
--- /dev/null
+++ b/test/go.sum
@@ -0,0 +1,186 @@
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
+github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
+github.com/alecthomas/chroma v0.10.0/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
+github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/aquasecurity/defsec v0.93.2-0.20231201010509-455085f613e1 h1:oeo+IclFPQggaRTFIe0qwLDLYXS3ZZOGMWltP38zPAc=
+github.com/aquasecurity/defsec v0.93.2-0.20231201010509-455085f613e1/go.mod h1:NBF6hvbQSc4s/WCHdKV5sNNxLl258M2OiIFoUfgEn/k=
+github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842 h1:RnxM3eTcwPlA/WBwnmaEpeEk3WOCDcnz7yTIFxVL7us=
+github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842/go.mod h1:BmEeSFgmBjo3avCli71736sy0veGcSUzGATupp1MCgA=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dlclark/regexp2 v1.4.0 h1:F1rxgk7p4uKjwIQxBs9oAXe5CqrXlCduYEJvrF4u93E=
+github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
+github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819 h1:RIB4cRk+lBqKK3Oy0r2gRX4ui7tuhiZq2SuTtTCi0/0=
+github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
+github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
+github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f h1:Pz0DHeFij3XFhoBRGUDPzSJ+w2UcK5/0JvF8DRI58r8=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f/go.mod h1:8LHG1a3SRW71ettAD/jW13h8c6AqjVSeL11RAdgaqpo=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
+github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
+github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
+github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5RPI=
+github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/liamg/iamgo v0.0.9 h1:tADGm3xVotyRJmuKKaH4+zsBn7LOcvgdpuF3WsSKW3c=
+github.com/liamg/iamgo v0.0.9/go.mod h1:Kk6ZxBF/GQqG9nnaUjIi6jf+WXNpeOTyhwc6gnguaZQ=
+github.com/liamg/jfather v0.0.7 h1:Xf78zS263yfT+xr2VSo6+kyAy4ROlCacRqJG7s5jt4k=
+github.com/liamg/jfather v0.0.7/go.mod h1:xXBGiBoiZ6tmHhfy5Jzw8sugzajwYdi6VosIpB3/cPM=
+github.com/liamg/memoryfs v1.6.0 h1:jAFec2HI1PgMTem5gR7UT8zi9u4BfG5jorCRlLH06W8=
+github.com/liamg/memoryfs v1.6.0/go.mod h1:z7mfqXFQS8eSeBBsFjYLlxYRMRyiPktytvYCYTb3BSk=
+github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
+github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/owenrumney/squealer v1.2.1 h1:4ryMMT59aaz8VMsqsD+FDkarADJz0F1dcq2fd0DRR+c=
+github.com/owenrumney/squealer v1.2.1/go.mod h1:7D0a/+Bouwy504YhaWsBYW73kyklSEq1MNf6zsNoTRg=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
+github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.13.0 h1:It5dfKTTZHe9aeppbNOda3mN7Ag7sg6QkBNm6TkyFa0=
+github.com/zclconf/go-cty v1.13.0/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/test/rules_test.go b/test/rules_test.go
new file mode 100644
index 0000000..600c789
--- /dev/null
+++ b/test/rules_test.go
@@ -0,0 +1,46 @@
+package test
+
+import (
+ "fmt"
+ "os"
+ "path/filepath"
+ "strings"
+ "testing"
+
+ "github.com/aquasecurity/defsec/pkg/framework"
+ "github.com/aquasecurity/defsec/pkg/rules"
+ "github.com/stretchr/testify/require"
+)
+
+func TestAVDIDs(t *testing.T) {
+ existing := make(map[string]struct{})
+ for _, rule := range rules.GetRegistered(framework.ALL) {
+ t.Run(rule.LongID(), func(t *testing.T) {
+ if rule.GetRule().AVDID == "" {
+ t.Errorf("Rule has no AVD ID: %#v", rule)
+ return
+ }
+ if _, ok := existing[rule.GetRule().AVDID]; ok {
+ t.Errorf("Rule detected with duplicate AVD ID: %s", rule.GetRule().AVDID)
+ }
+ })
+ existing[rule.GetRule().AVDID] = struct{}{}
+ }
+}
+
+func TestRulesAgainstExampleCode(t *testing.T) {
+ for _, rule := range rules.GetRegistered(framework.ALL) {
+ testName := fmt.Sprintf("%s/%s", rule.GetRule().AVDID, rule.LongID())
+ t.Run(testName, func(t *testing.T) {
+ rule := rule
+ t.Parallel()
+
+ t.Run("avd docs", func(t *testing.T) {
+ provider := strings.ToLower(rule.GetRule().Provider.ConstName())
+ service := strings.ToLower(strings.ReplaceAll(rule.GetRule().Service, "-", ""))
+ _, err := os.Stat(filepath.Join("..", "cmd", "trivy-policies-generator", "avd_docs", provider, service, rule.GetRule().AVDID, "docs.md"))
+ require.NoError(t, err)
+ })
+ })
+ }
+}