Detecting potentially non-compliant short-lived assets in a computing platform
Provided are a computer program product, system, and method for detecting potentially non-compliant short-lived assets in a computing platform. In response to a command to delete a program module, a determination is made as to whether the program module has a life less than a predetermined time. A determination is made of a subset of assessment rules from at least one compliance profile to execute in response to determining that the life of the program module is less than the predetermined time. The subset of assessment rules is executed in the computational platform to determine the program module compliance with the subset of assessment rules. Compliance results of the program module compliance with the subset of assessment rules are saved.
1 . A computer program product for performing a compliance scan of program modules in a computing platform, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:
in response to a command to delete a program module, determining whether the program module has a life less than a predetermined time;
determining a subset of assessment rules from at least one compliance profile to execute in response to determining that the life of the program module is less than the predetermined time;
executing the subset of assessment rules in the computational platform to determine the program module compliance with the subset of assessment rules;
saving compliance results of the program module compliance with the subset of assessment rules; and
deleting the program module after the executing the subset of assessment rules.
2 . The computer program product of claim 1 , wherein the program module is deleted in response to the saving the compliance results.
3 . The computer program product of claim 1 , wherein the predetermined time comprises a time interval between scheduled full compliance scans.
4 . The computer program product of claim 1 , wherein the operations further comprise:
performing a full compliance scan executing the assessment rules in at least one compliance profile at scheduled times, wherein the executing the subset of assessment rules is performed during a time interval between two of a scheduled full compliance scans.
5 . The computer program product of claim 1 , wherein the operations further comprise:
detecting whether the program module has engaged in a pattern of activity associated with a behavioral attribute, wherein the determined subset of assessment rules includes at least one assessment rule associated with the behavioral attribute detected for the program module.
6 . The computer program product of claim 5 , wherein the operations further comprise:
indicating program modules detected to have a pattern of activity associated with a behavioral attribute in an inventory list, wherein the inventory list indicates the behavioral attribute detected for the program module to delete, and wherein the determined subset of assessment rules is associated with the behavioral attribute indicated for the program module in the inventory list; and
deleting indication of the program module from the inventory list in response to deleting the program module from the computing platform.
7 . The computer program product of claim 5 , wherein the behavioral attribute is one of a plurality of behavioral attributes having associated patterns of activity, including at least a plurality of:
a short life span;
specified abnormal behavior;
unexpected performance degradation caused by the program module;
price change in cost of execution of the program module exceeding a cost constraint;
high security profile; and
a specified role based access control role assigned to the program module.
8 . The computer program product of claim 1 , wherein the program module is selected from the group consisting of a container comprising an application and dependencies of the application on the computing platform; a pod consisting of at least one container on the computing platform; and a virtual machine.
9 . A system for performing a compliance scan of program modules in a computing platform, comprising:
a processor; and
a computer readable storage medium having computer readable program code embodied therein that when executed by the processor performs operations, the operations comprising:
in response to a command to delete a program module, determining whether the program module has a life less than a predetermined time;
determining a subset of assessment rules from at least one compliance profile to execute in response to determining that the life of the program module is less than the predetermined time;
executing the subset of assessment rules in the computational platform to determine the program module compliance with the subset of assessment rules;
saving compliance results of the program module compliance with the subset of assessment rules; and
deleting the program module after the executing the subset of assessment rules.
10 . The system of claim 9 , wherein the program module is deleted in response to the saving the compliance results.
11 . The system of claim 9 , wherein the predetermined time comprises a time interval between scheduled full compliance scans.
12 . The system of claim 9 , wherein the operations further comprise:
performing a full compliance scan executing the assessment rules in at least one compliance profile at scheduled times, wherein the executing the subset of assessment rules is performed during a time interval between two of a scheduled full compliance scans.
13 . The system of claim 9 , wherein the operations further comprise:
detecting whether the program module has engaged in a pattern of activity associated with a behavioral attribute, wherein the determined subset of assessment rules includes at least one assessment rule associated with the behavioral attribute detected for the program module.
14 . The system of claim 13 , wherein the operations further comprise:
indicating program modules detected to have a pattern of activity associated with a behavioral attribute in an inventory list, wherein the inventory list indicates the behavioral attribute detected for the program module to delete, and wherein the determined subset of assessment rules is associated with the behavioral attribute indicated for the program module in the inventory list; and
deleting indication of the program module from the inventory list in response to deleting the program module from the computing platform.
15 . A method for performing a compliance scan of program modules in a computing platform, comprising:
in response to a command to delete a program module, determining whether the program module has a life less than a predetermined time;
determining a subset of assessment rules from at least one compliance profile to execute in response to determining that the life of the program module is less than the predetermined time;
executing the subset of assessment rules in the computational platform to determine the program module compliance with the subset of assessment rules;
saving compliance results of the program module compliance with the subset of assessment rules; and
deleting the program module after the executing the subset of assessment rules.
16 . The method of claim 15 , wherein the program module is deleted in response to saving the compliance results.
17 . The method of claim 15 , wherein the predetermined time comprises a time interval between scheduled full compliance scans.
18 . The method of claim 15 , further comprising:
performing a full compliance scan executing the assessment rules in at least one compliance profile at scheduled times, wherein the executing the subset of assessment rules is performed during a time interval between two of a scheduled full compliance scans.
19 . The method of claim 15 , further comprising:
detecting whether the program module has engaged in a pattern of activity associated with a behavioral attribute, wherein the determined subset of assessment rules includes at least one assessment rule associated with the behavioral attribute detected for the program module.
20 . The method of claim 19 , further comprising:
indicating program modules detected to have a pattern of activity associated with a behavioral attribute in an inventory list, wherein the inventory list indicates the behavioral attribute detected for the program module to delete, and wherein the determined subset of assessment rules is associated with the behavioral attribute indicated for the program module in the inventory list; and
deleting indication of the program module from the inventory list in response to deleting the program module from the computing platform.