Motivation

Rego library modules (e.g. terraform.rego, common.rego) are currently embedded in the binary at build time. Serving them from the backend instead lets the team update library logic without a scanner release, and keeps the binary smaller over time. The embedded assets remain as a transparent offline fallback so scans still work without network access.

Related Ticket: K9CODESEC-2546

Changes

Datadog client

A new Library type and GetLibraries(ctx) (map[string]Library, error) method are added to the Client interface and implemented on datadogClient. The implementation calls GET /api/v2/static-analysis/iac/libraries, unmarshals the JSON:API response, and returns a map keyed by library ID.

DatadogSource library loading

DatadogSource now fetches libraries from the backend on first use via a sync.Once-guarded loadLibraries call. GetQueryLibrary checks the backend result first; when the backend is unreachable (or returns no entry for the requested platform) it falls back transparently to the existing QueriesSource backed by the embedded ./assets/libraries directory.

The internal field librarySource is renamed to libraryFallback to make intent clear; the existing WithLibrarySource option is kept as an alias so no call sites need updating.

Counterpart PRs

• dd-source: https://github.com/DataDog/dd-source/pull/479873
• Rules: https://github.com/DataDog/datadog-iac-scanner-default-rules/pull/51

QA Instruction

CI should pass.

Impact

The scan pipeline is the only affected surface. The fallback to embedded assets is automatic, so behaviour for offline or CI environments is unchanged.