Skip to content

fix: correct cloud capture and rego policy details #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dangrondahl merged 2 commits into from
Nov 3, 2026
Merged

fix: correct cloud capture and rego policy details #492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3689550
fix: correct cloud capture and rego policy details
mintlify[bot] Nov 3, 2026
2341c21
fix: narrow lambda tag collision and link local input data
mintlify[bot] Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions administration/cloud_capture/getting_started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,8 @@ curl -X PUT "https://app.kosli.com/api/v2/cloud-capture/<your-org>/settings" \
"enabled": true,
"default_regions": {"aws": ["eu-west-1"]},
"scan_interval_minutes": 5,
"skip_tags": {"aws": [{"key": "kosli-capture", "value": "false"}]}
"skip_tags": {"aws": [{"key": "kosli-capture", "value": "false"}]},
"dry_run": false
}'
```
</Tab>
Expand Down Expand Up @@ -184,7 +185,7 @@ How a template is rendered:
- A resource that does not carry a tag the template names is not captured, and the scan reports it as failed. So is a resource whose rendered name Kosli does not accept, for example because a tag value contains a space. A tag that is present with an empty value renders empty.

<Warning>
Give every resource its own name. A template that renders the same name for two resources sends both into one environment, and that environment then switches between the two resources on every scan. This happens with `aws-prod` on an account with two ECS clusters, with a template that has no `{region}` on an account scanned in two regions, and with a template that has no `{account_id}` when two accounts hold a cluster of the same name. It also happens with a template built only from `{tag:Key}` placeholders: those are empty for Lambda functions, so `aws-{tag:Env}` sends every region's Lambda functions into `aws`. Run a [dry run](#dry-run) to check the names before you rely on them.
Give every resource its own name. A template that renders the same name for two resources sends both into one environment, and that environment then switches between the two resources on every scan. This happens with `aws-prod` on an account with two ECS clusters, with a template that has no `{region}` on an account scanned in two regions, and with a template that has no `{account_id}` when two accounts hold a cluster of the same name. It also happens when a `{tag:Key}` placeholder is the only part that would tell resources apart: tag placeholders are empty for Lambda functions, so `aws-{tag:Env}` sends every region's Lambda functions into `aws`. Run a [dry run](#dry-run) to check the names before you rely on them.
</Warning>

Through the API, the template is `environment_name_template` on the same settings resource as the skip tags above. Leaving it out, or sending `null`, uses the default template. A template that breaks the rules above is refused with a `400` response.
Expand Down
4 changes: 2 additions & 2 deletions policy-reference/rego_policy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ A policy that imports Ergo cannot be evaluated with `kosli evaluate trail`, whic

| Version status | Meaning | CLI exit code |
|---|---|---|
| `valid` | The version can be evaluated. Evaluations run the newest valid version. | `0` |
| `valid` | The version can be evaluated. Evaluations run the newest valid version unless you pin one with `--identifier <id>@v<n>`. See [Pinning a policy version](/tutorials/working_with_controls#pinning-a-policy-version). | `0` |
| `rejected` | The policy is at fault. The reason is printed. | `1` |
| `failed` | Kosli could not validate it. Publish again to retry. | `1` |
| `pending` | Validation has not finished within the CLI's 30-second wait. | `1` |
Expand Down Expand Up @@ -404,7 +404,7 @@ Allows only when every trail in `input.trails` has a compliant pull request atte

[`kosli evaluate trail`](/client_reference/kosli_evaluate_trail) and [`kosli evaluate trails`](/client_reference/kosli_evaluate_trails) fetch trail data from Kosli and evaluate a local policy file in the CLI, passed with `--policy`. A local evaluation records nothing: it cannot record a decision against a control. To try a policy on the server's input before publishing it, use `kosli evaluate policy --path` instead.

To evaluate the same policy file on the Kosli server instead, add `--server-side` (beta) to either command. Kosli builds the input from the trails you name, so the CLI reads no trail data. The flag can't be combined with `--attestations`, `--show-input` or `--output-rule`, and a server-side evaluation takes at most 100 trails.
To evaluate a policy file on the Kosli server instead, add `--server-side` (beta) to either command. Kosli builds the input from the trails you name as [trail moments](#trail-moment), so the CLI reads no trail data. A policy written for local input may need its field paths changed first. See [Local input data](#local-input-data). The flag can't be combined with `--attestations`, `--show-input` or `--output-rule`, and a server-side evaluation takes at most 100 trails.

A local evaluation differs from a server-side one:

Expand Down
Loading