aquasec.ContainerRuntimePolicy

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aquasec = Pulumiverse.Aquasec;

return await Deployment.RunAsync(() => 
{
    var containerRuntimePolicy = new Aquasec.ContainerRuntimePolicy("containerRuntimePolicy", new()
    {
        AllowedExecutables = new[]
        {
            "exe",
            "bin",
        },
        AllowedRegistries = new[]
        {
            "registry1",
            "registry2",
        },
        ApplicationScopes = new[]
        {
            "Global",
        },
        AuditAllNetworkActivity = true,
        AuditAllProcessesActivity = true,
        AuditFullCommandArguments = true,
        BlockAccessHostNetwork = true,
        BlockAddingCapabilities = true,
        BlockContainerExec = true,
        BlockCryptocurrencyMining = true,
        BlockFilelessExec = true,
        BlockLowPortBinding = true,
        BlockNonCompliantImages = true,
        BlockNonCompliantWorkloads = true,
        BlockNonK8sContainers = true,
        BlockPrivilegedContainers = true,
        BlockReverseShell = true,
        BlockRootUser = true,
        BlockUnregisteredImages = true,
        BlockUseIpcNamespace = true,
        BlockUsePidNamespace = true,
        BlockUseUserNamespace = true,
        BlockUseUtsNamespace = true,
        BlockedCapabilities = new[]
        {
            "AUDIT_CONTROL",
            "AUDIT_WRITE",
        },
        BlockedExecutables = new[]
        {
            "exe1",
            "exe2",
        },
        BlockedFiles = new[]
        {
            "test1",
            "test2",
        },
        BlockedInboundPorts = new[]
        {
            "80",
            "8080",
        },
        BlockedOutboundPorts = new[]
        {
            "90",
            "9090",
        },
        BlockedPackages = new[]
        {
            "pkg",
            "pkg2",
        },
        BlockedVolumes = new[]
        {
            "blocked",
            "vol",
        },
        ContainerExecAllowedProcesses = new[]
        {
            "proc1",
            "proc2",
        },
        Description = "container_runtime_policy",
        EnableDriftPrevention = true,
        EnableForkGuard = true,
        EnableIpReputationSecurity = true,
        EnablePortScanDetection = true,
        Enabled = true,
        Enforce = false,
        ExceptionalReadonlyFilesAndDirectories = new[]
        {
            "readonly2",
            "/dir2/",
        },
        FileIntegrityMonitoring = new Aquasec.Inputs.ContainerRuntimePolicyFileIntegrityMonitoringArgs
        {
            ExcludedPaths = new[]
            {
                "expaths",
            },
            ExcludedProcesses = new[]
            {
                "exprocess",
            },
            ExcludedUsers = new[]
            {
                "expuser",
            },
            MonitorAttributes = true,
            MonitorCreate = true,
            MonitorDelete = true,
            MonitorModify = true,
            MonitorRead = true,
            MonitoredPaths = new[]
            {
                "paths",
            },
            MonitoredProcesses = new[]
            {
                "process",
            },
            MonitoredUsers = new[]
            {
                "user",
            },
        },
        ForkGuardProcessLimit = 13,
        LimitNewPrivileges = true,
        MalwareScanOptions = new Aquasec.Inputs.ContainerRuntimePolicyMalwareScanOptionsArgs
        {
            Action = "alert",
            Enabled = true,
        },
        MonitorSystemTimeChanges = true,
        ReadonlyFilesAndDirectories = new[]
        {
            "readonly",
            "/dir/",
        },
        ReverseShellAllowedIps = new[]
        {
            "ip1",
            "ip2",
        },
        ReverseShellAllowedProcesses = new[]
        {
            "proc1",
            "proc2",
        },
        ScopeExpression = "v1 || v2",
        ScopeVariables = new[]
        {
            new Aquasec.Inputs.ContainerRuntimePolicyScopeVariableArgs
            {
                Attribute = "kubernetes.cluster",
                Value = "default",
            },
            new Aquasec.Inputs.ContainerRuntimePolicyScopeVariableArgs
            {
                Attribute = "kubernetes.label",
                Name = "app",
                Value = "aqua",
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-aquasec/sdk/go/aquasec"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := aquasec.NewContainerRuntimePolicy(ctx, "containerRuntimePolicy", &aquasec.ContainerRuntimePolicyArgs{
			AllowedExecutables: pulumi.StringArray{
				pulumi.String("exe"),
				pulumi.String("bin"),
			},
			AllowedRegistries: pulumi.StringArray{
				pulumi.String("registry1"),
				pulumi.String("registry2"),
			},
			ApplicationScopes: pulumi.StringArray{
				pulumi.String("Global"),
			},
			AuditAllNetworkActivity:    pulumi.Bool(true),
			AuditAllProcessesActivity:  pulumi.Bool(true),
			AuditFullCommandArguments:  pulumi.Bool(true),
			BlockAccessHostNetwork:     pulumi.Bool(true),
			BlockAddingCapabilities:    pulumi.Bool(true),
			BlockContainerExec:         pulumi.Bool(true),
			BlockCryptocurrencyMining:  pulumi.Bool(true),
			BlockFilelessExec:          pulumi.Bool(true),
			BlockLowPortBinding:        pulumi.Bool(true),
			BlockNonCompliantImages:    pulumi.Bool(true),
			BlockNonCompliantWorkloads: pulumi.Bool(true),
			BlockNonK8sContainers:      pulumi.Bool(true),
			BlockPrivilegedContainers:  pulumi.Bool(true),
			BlockReverseShell:          pulumi.Bool(true),
			BlockRootUser:              pulumi.Bool(true),
			BlockUnregisteredImages:    pulumi.Bool(true),
			BlockUseIpcNamespace:       pulumi.Bool(true),
			BlockUsePidNamespace:       pulumi.Bool(true),
			BlockUseUserNamespace:      pulumi.Bool(true),
			BlockUseUtsNamespace:       pulumi.Bool(true),
			BlockedCapabilities: pulumi.StringArray{
				pulumi.String("AUDIT_CONTROL"),
				pulumi.String("AUDIT_WRITE"),
			},
			BlockedExecutables: pulumi.StringArray{
				pulumi.String("exe1"),
				pulumi.String("exe2"),
			},
			BlockedFiles: pulumi.StringArray{
				pulumi.String("test1"),
				pulumi.String("test2"),
			},
			BlockedInboundPorts: pulumi.StringArray{
				pulumi.String("80"),
				pulumi.String("8080"),
			},
			BlockedOutboundPorts: pulumi.StringArray{
				pulumi.String("90"),
				pulumi.String("9090"),
			},
			BlockedPackages: pulumi.StringArray{
				pulumi.String("pkg"),
				pulumi.String("pkg2"),
			},
			BlockedVolumes: pulumi.StringArray{
				pulumi.String("blocked"),
				pulumi.String("vol"),
			},
			ContainerExecAllowedProcesses: pulumi.StringArray{
				pulumi.String("proc1"),
				pulumi.String("proc2"),
			},
			Description:                pulumi.String("container_runtime_policy"),
			EnableDriftPrevention:      pulumi.Bool(true),
			EnableForkGuard:            pulumi.Bool(true),
			EnableIpReputationSecurity: pulumi.Bool(true),
			EnablePortScanDetection:    pulumi.Bool(true),
			Enabled:                    pulumi.Bool(true),
			Enforce:                    pulumi.Bool(false),
			ExceptionalReadonlyFilesAndDirectories: pulumi.StringArray{
				pulumi.String("readonly2"),
				pulumi.String("/dir2/"),
			},
			FileIntegrityMonitoring: &aquasec.ContainerRuntimePolicyFileIntegrityMonitoringArgs{
				ExcludedPaths: pulumi.StringArray{
					pulumi.String("expaths"),
				},
				ExcludedProcesses: pulumi.StringArray{
					pulumi.String("exprocess"),
				},
				ExcludedUsers: pulumi.StringArray{
					pulumi.String("expuser"),
				},
				MonitorAttributes: pulumi.Bool(true),
				MonitorCreate:     pulumi.Bool(true),
				MonitorDelete:     pulumi.Bool(true),
				MonitorModify:     pulumi.Bool(true),
				MonitorRead:       pulumi.Bool(true),
				MonitoredPaths: pulumi.StringArray{
					pulumi.String("paths"),
				},
				MonitoredProcesses: pulumi.StringArray{
					pulumi.String("process"),
				},
				MonitoredUsers: pulumi.StringArray{
					pulumi.String("user"),
				},
			},
			ForkGuardProcessLimit: pulumi.Int(13),
			LimitNewPrivileges:    pulumi.Bool(true),
			MalwareScanOptions: &aquasec.ContainerRuntimePolicyMalwareScanOptionsArgs{
				Action:  pulumi.String("alert"),
				Enabled: pulumi.Bool(true),
			},
			MonitorSystemTimeChanges: pulumi.Bool(true),
			ReadonlyFilesAndDirectories: pulumi.StringArray{
				pulumi.String("readonly"),
				pulumi.String("/dir/"),
			},
			ReverseShellAllowedIps: pulumi.StringArray{
				pulumi.String("ip1"),
				pulumi.String("ip2"),
			},
			ReverseShellAllowedProcesses: pulumi.StringArray{
				pulumi.String("proc1"),
				pulumi.String("proc2"),
			},
			ScopeExpression: pulumi.String("v1 || v2"),
			ScopeVariables: aquasec.ContainerRuntimePolicyScopeVariableArray{
				&aquasec.ContainerRuntimePolicyScopeVariableArgs{
					Attribute: pulumi.String("kubernetes.cluster"),
					Value:     pulumi.String("default"),
				},
				&aquasec.ContainerRuntimePolicyScopeVariableArgs{
					Attribute: pulumi.String("kubernetes.label"),
					Name:      pulumi.String("app"),
					Value:     pulumi.String("aqua"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aquasec.ContainerRuntimePolicy;
import com.pulumi.aquasec.ContainerRuntimePolicyArgs;
import com.pulumi.aquasec.inputs.ContainerRuntimePolicyFileIntegrityMonitoringArgs;
import com.pulumi.aquasec.inputs.ContainerRuntimePolicyMalwareScanOptionsArgs;
import com.pulumi.aquasec.inputs.ContainerRuntimePolicyScopeVariableArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var containerRuntimePolicy = new ContainerRuntimePolicy("containerRuntimePolicy", ContainerRuntimePolicyArgs.builder()        
            .allowedExecutables(            
                "exe",
                "bin")
            .allowedRegistries(            
                "registry1",
                "registry2")
            .applicationScopes("Global")
            .auditAllNetworkActivity(true)
            .auditAllProcessesActivity(true)
            .auditFullCommandArguments(true)
            .blockAccessHostNetwork(true)
            .blockAddingCapabilities(true)
            .blockContainerExec(true)
            .blockCryptocurrencyMining(true)
            .blockFilelessExec(true)
            .blockLowPortBinding(true)
            .blockNonCompliantImages(true)
            .blockNonCompliantWorkloads(true)
            .blockNonK8sContainers(true)
            .blockPrivilegedContainers(true)
            .blockReverseShell(true)
            .blockRootUser(true)
            .blockUnregisteredImages(true)
            .blockUseIpcNamespace(true)
            .blockUsePidNamespace(true)
            .blockUseUserNamespace(true)
            .blockUseUtsNamespace(true)
            .blockedCapabilities(            
                "AUDIT_CONTROL",
                "AUDIT_WRITE")
            .blockedExecutables(            
                "exe1",
                "exe2")
            .blockedFiles(            
                "test1",
                "test2")
            .blockedInboundPorts(            
                "80",
                "8080")
            .blockedOutboundPorts(            
                "90",
                "9090")
            .blockedPackages(            
                "pkg",
                "pkg2")
            .blockedVolumes(            
                "blocked",
                "vol")
            .containerExecAllowedProcesses(            
                "proc1",
                "proc2")
            .description("container_runtime_policy")
            .enableDriftPrevention(true)
            .enableForkGuard(true)
            .enableIpReputationSecurity(true)
            .enablePortScanDetection(true)
            .enabled(true)
            .enforce(false)
            .exceptionalReadonlyFilesAndDirectories(            
                "readonly2",
                "/dir2/")
            .fileIntegrityMonitoring(ContainerRuntimePolicyFileIntegrityMonitoringArgs.builder()
                .excludedPaths("expaths")
                .excludedProcesses("exprocess")
                .excludedUsers("expuser")
                .monitorAttributes(true)
                .monitorCreate(true)
                .monitorDelete(true)
                .monitorModify(true)
                .monitorRead(true)
                .monitoredPaths("paths")
                .monitoredProcesses("process")
                .monitoredUsers("user")
                .build())
            .forkGuardProcessLimit(13)
            .limitNewPrivileges(true)
            .malwareScanOptions(ContainerRuntimePolicyMalwareScanOptionsArgs.builder()
                .action("alert")
                .enabled(true)
                .build())
            .monitorSystemTimeChanges("true")
            .readonlyFilesAndDirectories(            
                "readonly",
                "/dir/")
            .reverseShellAllowedIps(            
                "ip1",
                "ip2")
            .reverseShellAllowedProcesses(            
                "proc1",
                "proc2")
            .scopeExpression("v1 || v2")
            .scopeVariables(            
                ContainerRuntimePolicyScopeVariableArgs.builder()
                    .attribute("kubernetes.cluster")
                    .value("default")
                    .build(),
                ContainerRuntimePolicyScopeVariableArgs.builder()
                    .attribute("kubernetes.label")
                    .name("app")
                    .value("aqua")
                    .build())
            .build());

    }
}

import pulumi
import pulumiverse_aquasec as aquasec

container_runtime_policy = aquasec.ContainerRuntimePolicy("containerRuntimePolicy",
    allowed_executables=[
        "exe",
        "bin",
    ],
    allowed_registries=[
        "registry1",
        "registry2",
    ],
    application_scopes=["Global"],
    audit_all_network_activity=True,
    audit_all_processes_activity=True,
    audit_full_command_arguments=True,
    block_access_host_network=True,
    block_adding_capabilities=True,
    block_container_exec=True,
    block_cryptocurrency_mining=True,
    block_fileless_exec=True,
    block_low_port_binding=True,
    block_non_compliant_images=True,
    block_non_compliant_workloads=True,
    block_non_k8s_containers=True,
    block_privileged_containers=True,
    block_reverse_shell=True,
    block_root_user=True,
    block_unregistered_images=True,
    block_use_ipc_namespace=True,
    block_use_pid_namespace=True,
    block_use_user_namespace=True,
    block_use_uts_namespace=True,
    blocked_capabilities=[
        "AUDIT_CONTROL",
        "AUDIT_WRITE",
    ],
    blocked_executables=[
        "exe1",
        "exe2",
    ],
    blocked_files=[
        "test1",
        "test2",
    ],
    blocked_inbound_ports=[
        "80",
        "8080",
    ],
    blocked_outbound_ports=[
        "90",
        "9090",
    ],
    blocked_packages=[
        "pkg",
        "pkg2",
    ],
    blocked_volumes=[
        "blocked",
        "vol",
    ],
    container_exec_allowed_processes=[
        "proc1",
        "proc2",
    ],
    description="container_runtime_policy",
    enable_drift_prevention=True,
    enable_fork_guard=True,
    enable_ip_reputation_security=True,
    enable_port_scan_detection=True,
    enabled=True,
    enforce=False,
    exceptional_readonly_files_and_directories=[
        "readonly2",
        "/dir2/",
    ],
    file_integrity_monitoring=aquasec.ContainerRuntimePolicyFileIntegrityMonitoringArgs(
        excluded_paths=["expaths"],
        excluded_processes=["exprocess"],
        excluded_users=["expuser"],
        monitor_attributes=True,
        monitor_create=True,
        monitor_delete=True,
        monitor_modify=True,
        monitor_read=True,
        monitored_paths=["paths"],
        monitored_processes=["process"],
        monitored_users=["user"],
    ),
    fork_guard_process_limit=13,
    limit_new_privileges=True,
    malware_scan_options=aquasec.ContainerRuntimePolicyMalwareScanOptionsArgs(
        action="alert",
        enabled=True,
    ),
    monitor_system_time_changes=True,
    readonly_files_and_directories=[
        "readonly",
        "/dir/",
    ],
    reverse_shell_allowed_ips=[
        "ip1",
        "ip2",
    ],
    reverse_shell_allowed_processes=[
        "proc1",
        "proc2",
    ],
    scope_expression="v1 || v2",
    scope_variables=[
        aquasec.ContainerRuntimePolicyScopeVariableArgs(
            attribute="kubernetes.cluster",
            value="default",
        ),
        aquasec.ContainerRuntimePolicyScopeVariableArgs(
            attribute="kubernetes.label",
            name="app",
            value="aqua",
        ),
    ])

import * as pulumi from "@pulumi/pulumi";
import * as aquasec from "@pulumiverse/aquasec";

const containerRuntimePolicy = new aquasec.ContainerRuntimePolicy("containerRuntimePolicy", {
    allowedExecutables: [
        "exe",
        "bin",
    ],
    allowedRegistries: [
        "registry1",
        "registry2",
    ],
    applicationScopes: ["Global"],
    auditAllNetworkActivity: true,
    auditAllProcessesActivity: true,
    auditFullCommandArguments: true,
    blockAccessHostNetwork: true,
    blockAddingCapabilities: true,
    blockContainerExec: true,
    blockCryptocurrencyMining: true,
    blockFilelessExec: true,
    blockLowPortBinding: true,
    blockNonCompliantImages: true,
    blockNonCompliantWorkloads: true,
    blockNonK8sContainers: true,
    blockPrivilegedContainers: true,
    blockReverseShell: true,
    blockRootUser: true,
    blockUnregisteredImages: true,
    blockUseIpcNamespace: true,
    blockUsePidNamespace: true,
    blockUseUserNamespace: true,
    blockUseUtsNamespace: true,
    blockedCapabilities: [
        "AUDIT_CONTROL",
        "AUDIT_WRITE",
    ],
    blockedExecutables: [
        "exe1",
        "exe2",
    ],
    blockedFiles: [
        "test1",
        "test2",
    ],
    blockedInboundPorts: [
        "80",
        "8080",
    ],
    blockedOutboundPorts: [
        "90",
        "9090",
    ],
    blockedPackages: [
        "pkg",
        "pkg2",
    ],
    blockedVolumes: [
        "blocked",
        "vol",
    ],
    containerExecAllowedProcesses: [
        "proc1",
        "proc2",
    ],
    description: "container_runtime_policy",
    enableDriftPrevention: true,
    enableForkGuard: true,
    enableIpReputationSecurity: true,
    enablePortScanDetection: true,
    enabled: true,
    enforce: false,
    exceptionalReadonlyFilesAndDirectories: [
        "readonly2",
        "/dir2/",
    ],
    fileIntegrityMonitoring: {
        excludedPaths: ["expaths"],
        excludedProcesses: ["exprocess"],
        excludedUsers: ["expuser"],
        monitorAttributes: true,
        monitorCreate: true,
        monitorDelete: true,
        monitorModify: true,
        monitorRead: true,
        monitoredPaths: ["paths"],
        monitoredProcesses: ["process"],
        monitoredUsers: ["user"],
    },
    forkGuardProcessLimit: 13,
    limitNewPrivileges: true,
    malwareScanOptions: {
        action: "alert",
        enabled: true,
    },
    monitorSystemTimeChanges: true,
    readonlyFilesAndDirectories: [
        "readonly",
        "/dir/",
    ],
    reverseShellAllowedIps: [
        "ip1",
        "ip2",
    ],
    reverseShellAllowedProcesses: [
        "proc1",
        "proc2",
    ],
    scopeExpression: "v1 || v2",
    scopeVariables: [
        {
            attribute: "kubernetes.cluster",
            value: "default",
        },
        {
            attribute: "kubernetes.label",
            name: "app",
            value: "aqua",
        },
    ],
});

resources:
  containerRuntimePolicy:
    type: aquasec:ContainerRuntimePolicy
    properties:
      allowedExecutables:
        - exe
        - bin
      allowedRegistries:
        - registry1
        - registry2
      applicationScopes:
        - Global
      auditAllNetworkActivity: true
      auditAllProcessesActivity: true
      auditFullCommandArguments: true
      blockAccessHostNetwork: true
      blockAddingCapabilities: true
      blockContainerExec: true
      blockCryptocurrencyMining: true
      blockFilelessExec: true
      blockLowPortBinding: true
      blockNonCompliantImages: true
      blockNonCompliantWorkloads: true
      blockNonK8sContainers: true
      blockPrivilegedContainers: true
      blockReverseShell: true
      blockRootUser: true
      blockUnregisteredImages: true
      blockUseIpcNamespace: true
      blockUsePidNamespace: true
      blockUseUserNamespace: true
      blockUseUtsNamespace: true
      blockedCapabilities:
        - AUDIT_CONTROL
        - AUDIT_WRITE
      blockedExecutables:
        - exe1
        - exe2
      blockedFiles:
        - test1
        - test2
      blockedInboundPorts:
        - '80'
        - '8080'
      blockedOutboundPorts:
        - '90'
        - '9090'
      blockedPackages:
        - pkg
        - pkg2
      blockedVolumes:
        - blocked
        - vol
      containerExecAllowedProcesses:
        - proc1
        - proc2
      description: container_runtime_policy
      enableDriftPrevention: true
      enableForkGuard: true
      enableIpReputationSecurity: true
      enablePortScanDetection: true
      enabled: true
      enforce: false
      exceptionalReadonlyFilesAndDirectories:
        - readonly2
        - /dir2/
      fileIntegrityMonitoring:
        excludedPaths:
          - expaths
        excludedProcesses:
          - exprocess
        excludedUsers:
          - expuser
        monitorAttributes: true
        monitorCreate: true
        monitorDelete: true
        monitorModify: true
        monitorRead: true
        monitoredPaths:
          - paths
        monitoredProcesses:
          - process
        monitoredUsers:
          - user
      forkGuardProcessLimit: 13
      limitNewPrivileges: true
      malwareScanOptions:
        action: alert
        enabled: true
      monitorSystemTimeChanges: 'true'
      readonlyFilesAndDirectories:
        - readonly
        - /dir/
      reverseShellAllowedIps:
        - ip1
        - ip2
      reverseShellAllowedProcesses:
        - proc1
        - proc2
      scopeExpression: v1 || v2
      scopeVariables:
        - attribute: kubernetes.cluster
          value: default
        - attribute: kubernetes.label
          name: app
          value: aqua