prowler-compliance-review

适用场景

• 审查新增合规框架的 PR
• 审查修改现有合规框架的 PR
• 合并前验证合规框架的 JSON 结构

---

审查清单（关键）

检查项	命令/方法	通过标准
JSON 有效	python3 -m json.tool file.json	无语法错误
所有检查项均存在	运行验证脚本	缺失检查项数为 0
无重复 ID	运行验证脚本	重复的要求 ID 数为 0
更新日志片段	手动审查	prowler/changelog.d/ 下存在片段
仪表板文件	与现有文件对比	遵循既定模式
框架元数据	手动审查	已填写所有必填字段

---

命令

# 1. Validate JSON syntax
python3 -m json.tool prowler/compliance/{provider}/{framework}.json > /dev/null \
  && echo "Valid JSON" || echo "INVALID JSON"

# 2. Run full validation script
python3 skills/prowler-compliance-review/assets/validate_compliance.py \
  prowler/compliance/{provider}/{framework}.json

# 3. Compare dashboard with existing (find similar framework)
diff dashboard/compliance/{new_framework}.py \
     dashboard/compliance/{existing_framework}.py

---

决策树

JSON Valid?
├── No → FAIL: Fix JSON syntax errors
└── Yes ↓
    All Checks Exist in Codebase?
    ├── Missing checks → FAIL: Add missing checks or remove from framework
    └── All exist ↓
        Duplicate Requirement IDs?
        ├── Yes → FAIL: Fix duplicate IDs
        └── No ↓
            Changelog Fragment Present?
            ├── No → REQUEST CHANGES: Add changelog fragment
            └── Yes ↓
                Dashboard File Follows Pattern?
                ├── No → REQUEST CHANGES: Fix dashboard pattern
                └── Yes ↓
                    Framework Metadata Complete?
                    ├── No → REQUEST CHANGES: Add missing metadata
                    └── Yes → APPROVE

---

框架结构参考

合规框架是位于 prowler/compliance/{provider}/{framework}.json 的 JSON 文件。

{
  "Framework": "CIS",
  "Name": "CIS Provider Benchmark vX.Y.Z",
  "Version": "X.Y",
  "Provider": "AWS|Azure|GCP|...",
  "Description": "Framework description...",
  "Requirements": [
    {
      "Id": "1.1",
      "Description": "Requirement description",
      "Checks": ["check_name_1", "check_name_2"],
      "Attributes": [
        {
          "Section": "1 Section Name",
          "SubSection": "1.1 Subsection (optional)",
          "Profile": "Level 1|Level 2",
          "AssessmentStatus": "Automated|Manual",
          "Description": "...",
          "RationaleStatement": "...",
          "ImpactStatement": "...",
          "RemediationProcedure": "...",
          "AuditProcedure": "...",
          "AdditionalInformation": "...",
          "References": "...",
          "DefaultValue": "..."
        }
      ]
    }
  ]
}

---

常见问题

问题	检测方法	解决方案
缺失检查项	验证脚本报告存在缺失项	添加检查项实现，或从 Checks 数组中移除
重复 ID	验证脚本报告存在重复项	确保每项要求都有唯一 ID
Automated 的 Checks 为空	AssessmentStatus 为 Automated，但 Checks 为空	添加检查项，或改为 Manual
文件位置错误	框架不在 prowler/compliance/{provider}/ 下	移至正确目录
缺失仪表板文件	没有对应的 dashboard/compliance/{framework}.py	按照模式创建仪表板文件
缺失更新日志片段	PR 差异中没有片段文件	在 prowler/changelog.d/ 下添加片段

---

仪表板文件模式

仪表板文件必须位于 dashboard/compliance/ 下，并遵循以下精确模式：

import warnings

from dashboard.common_methods import get_section_containers_cis

warnings.filterwarnings("ignore")


def get_table(data):

    aux = data[
        [
            "REQUIREMENTS_ID",
            "REQUIREMENTS_DESCRIPTION",
            "REQUIREMENTS_ATTRIBUTES_SECTION",
            "CHECKID",
            "STATUS",
            "REGION",
            "ACCOUNTID",
            "RESOURCEID",
        ]
    ].copy()

    return get_section_containers_cis(
        aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
    )

---

测试合规框架

验证通过后，使用 Prowler 测试框架：

# Verify framework is detected
uv run python prowler-cli.py {provider} --list-compliance | grep {framework}

# Run a quick test with a single check from the framework
uv run python prowler-cli.py {provider} --compliance {framework} --check {check_name}

# Run full compliance scan (dry-run with limited checks)
uv run python prowler-cli.py {provider} --compliance {framework} --checks-limit 5

# Generate compliance report in multiple formats
uv run python prowler-cli.py {provider} --compliance {framework} -M csv json html

---

资源

• 验证脚本：参见 assets/validate_compliance.py
• 相关技能：创建框架请参见 prowler-compliance
• 文档：参见 references/review-checklist.md