cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 23c3067a-8cc9-480c-b645-7c1e0ad4bf60.md

title: Databricks Group Without User Or Instance Profile hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 23c3067a-8cc9-480c-b645-7c1e0ad4bf60 Query name: Databricks Group Without User Or Instance Profile Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Access Control URL: Databricks Group should have at least one user or one instance profile associated<br> ```tf title="Positive test num. 1 - tf file" hl_lines="16" resource "databricksgroup" "positivegroup" { display_name = "Some Group" allowclustercreate = true allowinstancepool_create = true } resource "databricksuser" "positiveuser" { user_name = "someone@example.com" } resource "databricksgroupmember" "positive_member" { groupid = databricksgroup.positive_group.id memberid = databricksuser.positive_user.id } resource "databricksgroup" "positivegroup_2" { display_name = "Some Group" allowclustercreate = true allowinstancepool_create = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="14" resource "databricksinstanceprofile" "positiveinstanceprofile" { instanceprofilearn = "myinstanceprofile_arn" } resource "databricksgroup" "positivegroup" { displayname = "mygroup_name" } resource "databricksgroupinstanceprofile" "mygroupinstanceprofile" { groupid = databricksgroup.positive_group.id instanceprofileid = databricksinstanceprofile.positiveinstanceprofile.id } resource "databricksgroup" "positivegroup2" { displayname = "mygroup_name" } ``` ```tf title="Negative test num. 1 - tf file" resource "databricksgroup" "negative1group" { display_name = "Some Group" allowclustercreate = true allowinstancepool_create = true } resource "databricksuser" "negative1user" { user_name = "someone@example.com" } resource "databricksgroupmember" "negative1_member" { groupid = databricksgroup.negative1_group.id memberid = databricksuser.negative1_user.id } ``` ```tf title="Negative test num. 2 - tf file" resource "databricksinstanceprofile" "negative2instanceprofile" { instanceprofilearn = "myinstanceprofile_arn" } resource "databricksgroup" "negative2group" { displayname = "mygroup_name" } resource "databricksgroupinstanceprofile" "negative2groupinstanceprofile" { groupid = databricksgroup.negative2_group.id instanceprofileid = databricksinstanceprofile.negative2instanceprofile.id } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-perf-result.md

layout: default title: mesheryctl-perf-result permalink: reference/mesheryctl/perf/result redirect_from: reference/mesheryctl/perf/result/ type: reference display-title: "false" language: en command: perf subcommand: result List performance test results List all the available test results of a performance profile <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl perf result [profile-name] [flags] </div> </pre> List Test results (maximum 25 results) <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl perf result saturday-profile </div> </pre> View other set of performance results with --page (maximum 25 results) <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl perf result saturday-profile --page 2 </div> </pre> View single performance result with detailed information <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl perf result saturday-profile --view </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for result -p, --page int (optional) List next set of performance results with --page (default = 1) (default 1) --view (optional) View single performance results with more info </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -o, --output-format string (optional) format to display in [json|yaml] -t, --token string (required) Path to meshery auth config -v, --verbose verbose output -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> Usage of mesheryctl perf result Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: EDB (App Definition and Development / Database)
File: license.md

The MIT License (MIT) Copyright (c) 2014 Mitchell Hashimoto Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Project: StarRocks (App Definition and Development / Database)
File: DROP_TABLE.md

displayed_sidebar: "English" This statement is used to delete a table. ```sql DROP TABLE [IF EXISTS] [dbname.]tablename [FORCE] ``` Note: After a table is dropped, you can use the statement to restore the table within a specified period (1 day by default). If DROP Table FORCE is executed, the table will be deleted directly and cannot be recovered without checking whether there are unfinished activities in the database. Generally, this operation is not recommended. Drop a table. ```sql DROP TABLE my_table; ``` If it exists, then drop the table on the specified database. ```sql DROP TABLE IF EXISTS exampledb.mytable; ``` Force to drop the table and clear its data on disk. ```sql DROP TABLE my_table FORCE; ```
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: README.md

This directory contains a library that implements various low-level operations for policies compiled into WebAssembly (Wasm). Specifically, the library implements most of the built-in functions provided by OPA. See the "Wasm" tag next to each function listed in the for the complete list, or the file for programmatic purposes. This library does not make any backwards compatibility guarantees. See the on Wasm for an overview of the integration, compilation options, and more. You should have Docker installed to build and test changes to the library. We commit the output of the build (`opa.wasm`) into the repository, so it's important for the build output to be reproducible. You can build the library by running `make build`. This will produce WASM executables under the `_obj` directory. You can test the library by running `make test`. By default, the test runner does not print messages when tests pass. If you run `make test VERBOSE=1` it will log all of the tests that were run. You can run `make hack` to start a shell inside the builder image. This is useful if you need to interact with low-level WASM tooling like `wasm-objdump`, `wasm2wat`, etc. or LLVM itself. You must manually push the builder image if you make changes to it (run `make builder` to produce a new Docker image). Set the `DEBUG` environment variable to `1` to enable generating binaries with debug symbols and a less aggressive optimization level. Eg: `DEBUG=1 make build`. If you make changes to the library, run the `make generate` in the parent directory and commit the results back to the repository. The `generate` target will: Build the OPA-WASM library Copy the library into the directory. Run the tool to generate the file.
Project: KICS (Provisioning / Security & Compliance)
File: fb2b0ecf-1492-491a-a70d-ba1df579175d.md

title: ECS No Load Balancer Attached hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fb2b0ecf-1492-491a-a70d-ba1df579175d Query name: ECS No Load Balancer Attached Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: Amazon ECS service should be configured to use Load Balancing to distribute traffic evenly across the tasks, which means there must exist at least one LoadBalancer.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="25 7" Resources: ECSService: Type: AWS::ECS::Service DependsOn: Listener Properties: Role: Ref: ECSServiceRole TaskDefinition: Ref: ECSTaskDefinition DesiredCount: 1 Cluster: Ref: ECSCluster ECSService2: Type: AWS::ECS::Service DependsOn: Listener Properties: Role: Ref: ECSServiceRole TaskDefinition: Ref: ECSTaskDefinition DesiredCount: 1 LoadBalancers: [] Cluster: Ref: ECSCluster ``` ```json title="Positive test num. 2 - json file" hl_lines="27 7" { "Resources": { "ECSService": { "DependsOn": [ "Listener" ], "Properties": { "Role": { "Ref": "ECSServiceRole" }, "TaskDefinition": { "Ref": "ECSTaskDefinition" }, "DesiredCount": 1, "Cluster": { "Ref": "ECSCluster" } }, "Type": "AWS::ECS::Service" }, "ECSService2": { "Properties": { "TaskDefinition": { "Ref": "ECSTaskDefinition" }, "DesiredCount": 1, "LoadBalancers": [], "Cluster": { "Ref": "ECSCluster" }, "Role": { "Ref": "ECSServiceRole" } }, "Type": "AWS::ECS::Service", "DependsOn": [ "Listener" ] } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: ECSService: Type: AWS::ECS::Service DependsOn: Listener Properties: Role: Ref: ECSServiceRole TaskDefinition: Ref: ECSTaskDefinition DesiredCount: 1 LoadBalancers: TargetGroupArn: Ref: TargetGroup ContainerPort: 80 ContainerName: sample-app Cluster: Ref: ECSCluster ``` ```json title="Negative test num. 2 - json file" { "Resources": { "ECSService": { "Type": "AWS::ECS::Service", "DependsOn": [ "Listener" ], "Properties": { "DesiredCount": 1, "LoadBalancers": [ { "TargetGroupArn": { "Ref": "TargetGroup" }, "ContainerPort": 80, "ContainerName": "sample-app" } ], "Cluster": { "Ref": "ECSCluster" }, "Role": { "Ref": "ECSServiceRole" }, "TaskDefinition": { "Ref": "ECSTaskDefinition" } } } } } ```
Project: Veinmind Tools (Provisioning / Security & Compliance)
File: veinmind-runner_completion_zsh.md

Generate the autocompletion script for zsh Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: echo "autoload -U compinit; compinit" >> ~/.zshrc To load completions in your current shell session: source <(veinmind-runner completion zsh); compdef _veinmind-runner veinmind-runner To load completions for every new session, execute once: veinmind-runner completion zsh > "${fpath[1]}/_veinmind-runner" veinmind-runner completion zsh > $(brew --prefix)/share/zsh/site-functions/_veinmind-runner You will need to start a new shell for this setup to take effect. ``` veinmind-runner completion zsh [flags] ``` ``` -h, --help help for zsh --no-descriptions disable completion descriptions ``` ``` -e, --exit-code int exit-code when veinmind-runner find security issues -g, --glob string specifies the pattern of plugin file to find -o, --output string output filepath of report --threads int threads for scan action (default 5) ``` - Generate the autocompletion script for the specified shell
Project: KICS (Provisioning / Security & Compliance)
File: 89561b03-cb35-44a9-a7e9-8356e71606f4.md

title: User With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 89561b03-cb35-44a9-a7e9-8356e71606f4 Query name: User With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:RunInstances", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PassRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KICS (Provisioning / Security & Compliance)
File: f97b7d23-568f-4bcc-9ac9-02df0d57fbba.md

title: S3 Bucket Allows Get Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f97b7d23-568f-4bcc-9ac9-02df0d57fbba Query name: S3 Bucket Allows Get Action From All Principals Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Get, for all Principals.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22 7" Resources: SampleBucketPolicy3: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "GetObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' SampleBucketPolicy4: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "DeleteObject" "GetObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Positive test num. 2 - json file" hl_lines="9 35" { "Resources": { "SampleBucketPolicy5": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": "GetObject", "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } }, "SampleBucketPolicy6": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": ["DeleteObject", "GetObject"], "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: SampleBucketPolicy1: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: 's3:GetObject' Effect: Deny Resource: '*' Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Negative test num. 2 - json file" { "Resources": { "SampleBucketPolicy2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject" ], "Effect": "Deny", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: rancher.md

Once Docker is installed, the next step will be to install a Kubernetes cluster. Under "Settings" in the Docker Desktop application, enable Kubernetes. In this how-to, will be used as it relies only on Docker. <pre class="codeblock-pre"> <div class="codeblock"><div class="clipboardjs">curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | bash k3d cluster create export $env:KUBECONFIG = "$(k3d.exe kubeconfig get 'k3s-default')"</div></div> </pre> If using Scoop, run the following in the PowerShell to install a Kubernetes cluster : <pre class="codeblock-pre"> <div class="codeblock"><div class="clipboardjs">scoop install k3d k3d cluster create export KUBECONFIG="$(k3d kubeconfig get 'k3s-default')"</div></div> </pre>
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.0.16.2.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Blocker | dfs -chown does not like "\_" underscore in user name* chown and chgrp commands allow more flexible names compared to 0.16. See 'fs -help chown'. Inform Users : YES.
Project: KubeEdge (Provisioning / Automation & Configuration)
File: MIGRATION_GUIDE.md

Starting from , the import path will be: "github.com/golang-jwt/jwt/v4" The `/v4` version will be backwards compatible with existing `v3.x.y` tags in this repo, as well as `github.com/dgrijalva/jwt-go`. For most users this should be a drop-in replacement, if you're having troubles migrating, please open an issue. You can replace all occurrences of `github.com/dgrijalva/jwt-go` or `github.com/golang-jwt/jwt` with `github.com/golang-jwt/jwt/v4`, either manually or by using tools such as `sed` or `gofmt`. And then you'd typically run: ``` go get github.com/golang-jwt/jwt/v4 go mod tidy ``` The original migration guide for older releases can be found at https://github.com/dgrijalva/jwt-go/blob/master/MIGRATION_GUIDE.md.
Project: KICS (Provisioning / Security & Compliance)
File: 8c415f6f-7b90-4a27-a44a-51047e1506f9.md

title: RDS With Backup Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8c415f6f-7b90-4a27-a44a-51047e1506f9 Query name: RDS With Backup Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="14" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 0 DeletionPolicy: Snapshot ``` ```json title="Positive test num. 2 - json file" hl_lines="6" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 0, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01" }, "DeletionPolicy": "Snapshot" } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 DeletionPolicy: Snapshot ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 7, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01" }, "DeletionPolicy": "Snapshot" } } } ```
Project: YugabyteDB (App Definition and Development / Database)
File: yba_storage-config_azure.md

Manage a YugabyteDB Anywhere Azure storage configuration Manage an Azure storage configuration in YugabyteDB Anywhere ``` yba storage-config azure [flags] ``` ``` -n, --name string [Optional] The name of the storage configuration for the operation. Required for create, delete, describe, update. -h, --help help for azure ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage YugabyteDB Anywhere storage configurations - Create an Azure YugabyteDB Anywhere storage configuration - Delete an Azure YugabyteDB Anywhere storage configuration - Describe an Azure YugabyteDB Anywhere storage configuration - List YugabyteDB Anywhere storage-configurations - Update an Azure YugabyteDB Anywhere storage configuration
Project: Meshery (Provisioning / Automation & Configuration)
File: containerssh.md

layout: integration title: Containerssh subtitle: Collaborative and visual infrastructure as code for Containerssh image: /assets/img/integrations/containerssh/icons/color/containerssh-color.svg permalink: extensibility/integrations/containerssh docURL: https://docs.meshery.io/extensibility/integrations/containerssh description: integrations-category: Tools integrations-subcategory: Security & Compliance registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations