Chapter 3. Creating a policy

Procedure

1. Configure your policy in the command line as a JSON or YAML string, as in the following example:

   ec validate image --policy '{
       "configuration": {
           "include": ["@minimal"]
       },
       "sources": [
           {
               "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"],
               "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"]
           }
       ]
   }' ...

2. (Optional) Exclude a particular package of rules from your Enterprise Contract policy, as in the following example:

   exclude:
   - attestation_task_bundle
   - slsa_build_scripted_build

   This command includes every rule from every package except for the rules in the specified packages.

3. (Optional) Exclude a single rule, as in the following example:

   exclude:
   - attestation_task_bundle.unacceptable_task_bundle

   This commands includes every rule from the attestation_task_bundle package except for the unacceptable_task_bundle rule.

4. (Optional) Include rules from only a particular package, as in the following example:

   include:
   - test
   - java

   This command includes only the rules from the specified packages.

5. (Optional) Include only some rules from a particular package. This means that you can specify both include and exclude to select only the rules you want your Enterprise Contract policy to include, as in the following example:

   include:
   - "*" 1
   - attestation_task_bundle.unacceptable_task_bundle
   exclude:
   - attestation_task_bundle.*

   1

   The asterisk (*) acts as a wildcard to match any package. Note that it does not match partial names, which means that, for example, you can’t specify "s*" to match every package that starts with "s".

   These commands specify that you want to include only the unacceptable_task_bundle rule from the attestation_task_bundle package, and exclude all the other rules in that package.

6. (Optional) Exclude certain checks so that Enterprise Contract can validate your container image even if those checks fail or don’t complete, as in the following example:

   exclude:
   - test:get-clair-scan
   - test:clamav-scan

   This command specifies that, if either of the identified checks fails or doesn’t complete, Enterprise Contract can still finish to validate your container image.

7. (Optional) Modify the defaults for rules in a package by running either the config.policy.include command or the config.policy.exclude command, along with a list of strings.

   Your list of strings should include one of the following:

   • "package name" - Choose from the packages in the Available rule collections list.
   • "rule name" - Specify a rule name by entering the name of the package and the rule code, separated by a dot (.), as in this example: attestation_type.unknown_att_type. You can find rule codes under "Attestation type" here.
   • "package name:term" - Some policy rules process a list of items. When you add "term" to the "package name" string, you can exclude or include a particular item from that list. This works similarly to "package name," except that it applies only to policy rules in the package that match that term. For example, if you run the test package, you can choose to ignore a given test case but include all the others.
   • "rule name:term" - This is similar to "package name:term" except that, instead of including or excluding an item from a package, you can include ot exclude a particular package policy rule.
   • "@collection name" - Add this to your string to specify a predefined collection of rules. TMake sure you prefix the collection name with the @ symbol. Choose from the available rule collections here.