[om986]

Summary

• Workload scans mount disks in a scanner account, subscription, or project. Production only creates a snapshot and shares it, so the worker no longer needs compute in the customer account.
• deploy/connect has Terraform/OpenTofu, CloudFormation, and shell scripts for the production and scanner roles. A test fails if a template grants an action the binary does not use.
• ADR 009 records the split. API collectors stay read-only, and Helm still does not schedule workload scans.

Test plan

• go test ./internal/workload/aws/ ./internal/workload/azure/ ./internal/workload/gcp/ ./internal/cmd/ ./deploy/connect/
• AWS production role has snapshot and share only; the scanner role copies, creates, and attaches
• Encrypted AWS volume fails closed without --kms-key, and the scanner principal is on the customer key policy
• An AMI scan copies the snapshot and leaves the AMI snapshot in place
• Apply the scanner stack, then the production stack, and run om scan workload aws from the worker

Made with Cursor

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: OpenSourceOM/core
• Branch: main
• File: .coderabbit.yaml
• Commit: a496fb9
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9fd85862-4e60-4711-a1b0-51f7bd612395

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn