Managing Policies
What is a Policy
A policy container includes the following elements:
Rule Sets
A policy is made up from a set of rules that are used to perform an evaluation on a source repository or container image. These rules can include checks on security vulnerabilities, package allowlists, denylists, configuration file contents, presence of credentials, manifest changes, exposed ports, or any user defined checks. These policies can be deployed site wide or customized for specific source repositories, container images, or categories of applications. A policy may contain one or more named rule sets.
Allowlists
An allowlist contains one or more exceptions that can be used during policy evaluation. For example allowing a CVE to be excluded from policy evaluation. A policy may contain multiple allowlists.
Mappings
A policy mapping defines which policies and allowlists should be used to perform the policy evaluation of a given source repository or container image. A policy may contain multiple mappings including wildcard mappings that apply to multiple elements.
Allowed Image
An allowed image defines one or more images that will always pass policy evaluation regardless of any policy violations. Allowed images can be specified by name, image ID, or image digest. A policy contains a single list of allowed images.
Denied Images
A denied Images list defines one or more images that will always fail policy evaluation. Denied images can be specified by name, image ID, or image digest. A policy contains a single list of denied images.
Policies
The Policy Manager displays a list of policies that are loaded in the system. Each policy has a unique name, unique ID (UUID), and an optional description.
Anchore Enterprise supports multiple policies. The Anchore API, CLI, and CI/CD plugins support specifying a policy when requesting an source repository or container image evaluation. For example, the development team may use a different set of policy checks than the operations team. In this case, the development team would specify their policy ID as part of their policy evaluation request.
If no policy ID is specified, then Anchore Enterprise will use the active policy which can be considered as the default policy. Only one policy can be set as default/active at any time. This policy will be highlighted with a green ribbon.
Note: policiess which are not marked as Active can still be explicitly requested as part of a policy evaluation.
If multiple users are accessing the Policy Manager, or if policy are being added or removed through the API or AnchoreCTL, then you may update the list of policies using the clicking Refresh the Bundle Data.
The following command can be run to list policies using AnchoreCTL:
# anchorectl policy list
Create a New Policy
- To create a new, empty policy, click Create New Policy.
Add a name for the policy. This name should be unique.
Optional: You can add a description.
The following example shows a policy called test. Notice the unique Bundle ID (UUID) that was automatically created by Anchore Enterprise.
Upload a Policy Bundle
If you have a JSON document containing an existing policy, then you can upload it into Anchore Enterprise.
- Click Add a Local File to upload or paste a valid policy JSON.
You can drag Policy Bundle files into the dropzone. Or, you can click the “Add a Local File” button to add from the local file system.
Click OK to perform a validation on a policy. Only validated policies may be stored by Anchore Enterprise.
Note: The following command can be run to add policies using AnchoreCTL
# anchorectl policy add --input /path/to/my/policy/bundle.json
Edit a Policy Bundle
You can edit existing policies at any time, including the policies, allowlists, mappings, and allowed or denied images.
- Click Edit Policy to open the policy viewer which has the following options.
- Policies tab: Edit or add policies and policy rules. See the policies section for more information.
- Allowlists tab: Edit or add allowlists associated with the policy.
- Mappings tab: Edit or add mappings and mapping rules. See the Policy Mappings section for more information.
- Allowed / Denied Images tab: Edit or add images that you want allowed or denied in a policy. Each of the policy elements can be edited by selecting the appropriate tab in the navigation bar.
Copy an Existing Policy Bundle
If you already have a policy that you would like to use as a base for another policy, you can make a copy of it, give it a new name, and then work with the policies, mappings, allowlists, and allowed or denied images.
- From the Tools list, select Copy Bundle.
- Enter a unique name for the copy of the policy.
Optional: You can add a description to explain the new policy. This is recommended.
Click OK to copy the policy.
Delete a Policy Bundle
If you no longer use a policy, you can delete it. An active (default) policy cannot be deleted. To delete the active policy first you must mark another policy as active.
- From the Tools menu, select Delete Bundle.
- Click Yes to confirm that you want to delete the policy.
*Warning: Once the policy is deleted, you cannot recover it.
Note: Use the following command to delete a policy using AnchoreCTL. The policy must be referenced by its UUID. For example:
# anchorectl policy delete 4c1627b0-3cd7-4d0f-97da-00be5aa835f4
Download a Policy Bundle
- From the Tools menu, select Download to JSON.
- The JSON file is downloaded just like any other downloaded file to your computer. Save the downloaded JSON file to your location of choice.
Note: Use the following command to download a policy using AnchoreCTL. The policy must be referenced by its UUID. For example:
# anchorectl policy get 4c1627b0-3cd7-4d0f-97da-00be5aa835f4 --detail > policy.json