Environment Variable Contains Secret

{
  "id": "f4996314-c3d7-4553-803b-b24ce7febe48",
  "name": "Environment Variable Contains Secret",
  "description": "Alert on deployments with environment variables that contain 'SECRET'",
  "rationale": "Using secrets in environment variables may allow inspection into your secrets from the host or even through the orchestrator UI.",
  "remediation": "Migrate your secrets from environment variables to orchestrator secrets or your security team's secret management solution.",
  "severity": "high",
  "categories": [
    "Security Best Practices"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "noobaa-core",
      "namespace": "openshift-storage"
    },
    {
      "name": "noobaa-endpoint",
      "namespace": "openshift-storage"
    },
    {
      "name": "ocs-operator",
      "namespace": "openshift-storage"
    },
    {
      "name": "ocm-agent",
      "namespace": "openshift-ocm-agent-operator"
    },
    {
      "name": "router-default",
      "namespace": "openshift-ingress"
    },
    {
      "name": "image-registry",
      "namespace": "openshift-image-registry"
    },
    {
      "name": "thanos-ruler-user-workload",
      "namespace": "openshift-user-workload-monitoring"
    },
    {
      "name": "klusterlet-addon-controller-v2",
      "namespace": "open-cluster-management"
    },
    {
      "name": "managedcluster-import-controller-v2",
      "namespace": "multicluster-engine"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "criterion",
    "field": "environment-variable",
    "values": [
      "RAW=.*SECRET.*|.*PASSWORD.*="
    ],
    "valuesOp": "or",
    "negate": false
  },
  "disabled": false
}

{
  "id": "f4996314-c3d7-4553-803b-b24ce7febe48",
  "name": "Environment Variable Contains Secret",
  "description": "Alert on deployments with environment variables that contain 'SECRET'",
  "rationale": "Using secrets in environment variables may allow inspection into your secrets from the host or even through the orchestrator UI.",
  "remediation": "Migrate your secrets from environment variables to orchestrator secrets or your security team's secret management solution.",
  "disabled": false,
  "categories": [
    "Security Best Practices"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on deployment noobaa-core in namespace openshift-storage",
      "deployment": {
        "name": "noobaa-core",
        "scope": {
          "cluster": "",
          "namespace": "openshift-storage",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment noobaa-endpoint in namespace openshift-storage",
      "deployment": {
        "name": "noobaa-endpoint",
        "scope": {
          "cluster": "",
          "namespace": "openshift-storage",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ocs-operator in namespace openshift-storage",
      "deployment": {
        "name": "ocs-operator",
        "scope": {
          "cluster": "",
          "namespace": "openshift-storage",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ocm-agent in openshift-ocm-agent-operator namespace",
      "deployment": {
        "name": "ocm-agent",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ocm-agent-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on router-default in openshift-ingress namespace",
      "deployment": {
        "name": "router-default",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ingress",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on image-registry in openshift-image-registry namespace",
      "deployment": {
        "name": "image-registry",
        "scope": {
          "cluster": "",
          "namespace": "openshift-image-registry",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on thanos-ruler-user-workload in openshift-user-workload-monitoring namespace",
      "deployment": {
        "name": "thanos-ruler-user-workload",
        "scope": {
          "cluster": "",
          "namespace": "openshift-user-workload-monitoring",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on klusterlet-addon-controller-v2 in namespace open-cluster-management",
      "deployment": {
        "name": "klusterlet-addon-controller-v2",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on managedcluster-import-controller-v2 in namespace multicluster-engine",
      "deployment": {
        "name": "managedcluster-import-controller-v2",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "HIGH_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "",
      "policyGroups": [
        {
          "fieldName": "Environment Variable",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "RAW=.*SECRET.*|.*PASSWORD.*="
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": null,
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}