Infrastructure as Code (IaC)

Quick start

Simply specify a directory containing IaC files such as Terraform, CloudFormation and Dockerfile.

  1. $ trivy config [YOUR_IaC_DIRECTORY]

Trivy will automatically fetch the managed policies and will keep them up-to-date in future scans.

Example

  1. $ ls build/
  2. Dockerfile
  3. $ trivy config ./build
  4. 2021-07-09T10:06:29.188+0300    INFO    Need to update the built-in policies
  5. 2021-07-09T10:06:29.188+0300    INFO    Downloading the built-in policies...
  6. 2021-07-09T10:06:30.520+0300    INFO    Detected config files: 1
  8. Dockerfile (dockerfile)
  9. =======================
  10. Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
  11. Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
  13. +---------------------------+------------+----------------------+----------+------------------------------------------+
  14. |           TYPE            | MISCONF ID |        CHECK         | SEVERITY |                 MESSAGE                  |
  15. +---------------------------+------------+----------------------+----------+------------------------------------------+
  16. | Dockerfile Security Check |   DS002    | Image user is 'root' |   HIGH   | Last USER command in                     |
  17. |                           |            |                      |          | Dockerfile should not be 'root'          |
  18. |                           |            |                      |          | -->avd.aquasec.com/appshield/ds002       |
  19. +---------------------------+------------+----------------------+----------+------------------------------------------+

Type detection

The specified directory can contain mixed types of IaC files. Trivy automatically detects config types and applies relevant policies.

For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, and Dockerfile in the same directory.

  1. $ ls iac/
  2. Dockerfile  deployment.yaml  main.tf
  3. $ trivy conf --severity HIGH,CRITICAL ./iac

Result

  1. 2021-07-09T11:51:08.212+0300    INFO    Need to update the built-in policies
  2. 2021-07-09T11:51:08.212+0300    INFO    Downloading the built-in policies...
  3. 2021-07-09T11:51:09.527+0300    INFO    Detected config files: 3
  5. Dockerfile (dockerfile)
  6. =======================
  7. Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
  8. Failures: 1 (HIGH: 1, CRITICAL: 0)
  10. +---------------------------+------------+----------------------+----------+------------------------------------------+
  11. |           TYPE            | MISCONF ID |        CHECK         | SEVERITY |                 MESSAGE                  |
  12. +---------------------------+------------+----------------------+----------+------------------------------------------+
  13. | Dockerfile Security Check |   DS002    | Image user is 'root' |   HIGH   | Last USER command in                     |
  14. |                           |            |                      |          | Dockerfile should not be 'root'          |
  15. |                           |            |                      |          | -->avd.aquasec.com/appshield/ds002       |
  16. +---------------------------+------------+----------------------+----------+------------------------------------------+
  18. deployment.yaml (kubernetes)
  19. ============================
  20. Tests: 28 (SUCCESSES: 15, FAILURES: 13, EXCEPTIONS: 0)
  21. Failures: 13 (HIGH: 1, CRITICAL: 0)
  23. +---------------------------+------------+----------------------------+----------+------------------------------------------+
  24. |           TYPE            | MISCONF ID |           CHECK            | SEVERITY |                 MESSAGE                  |
  25. +---------------------------+------------+----------------------------+----------+------------------------------------------+
  26. | Kubernetes Security Check |   KSV005   | SYS_ADMIN capability added |   HIGH   | Container 'hello-kubernetes' of          |
  27. |                           |            |                            |          | Deployment 'hello-kubernetes'            |
  28. |                           |            |                            |          | should not include 'SYS_ADMIN' in        |
  29. |                           |            |                            |          | 'securityContext.capabilities.add'       |
  30. |                           |            |                            |          | -->avd.aquasec.com/appshield/ksv005      |
  31. +---------------------------+------------+----------------------------+----------+------------------------------------------+
  33. main.tf (terraform)
  34. ===================
  35. Tests: 23 (SUCCESSES: 14, FAILURES: 9, EXCEPTIONS: 0)
  36. Failures: 9 (HIGH: 6, CRITICAL: 1)
  38. +------------------------------------------+------------+------------------------------------------+----------+--------------------------------------------------------+
  39. |                   TYPE                   | MISCONF ID |                  CHECK                   | SEVERITY |                        MESSAGE                         |
  40. +------------------------------------------+------------+------------------------------------------+----------+--------------------------------------------------------+
  41. |   Terraform Security Check powered by    |   AWS003   | AWS Classic resource usage.              |   HIGH   | Resource                                               |
  42. |                  tfsec                   |            |                                          |          | 'aws_db_security_group.my-group'                       |
  43. |                                          |            |                                          |          | uses EC2 Classic. Use a VPC instead.                   |
  44. |                                          |            |                                          |          | -->tfsec.dev/docs/aws/AWS003/                          |
  45. +                                          +------------+------------------------------------------+----------+--------------------------------------------------------+
  46. |                                          |   AWS004   | Use of plain HTTP.                       | CRITICAL | Resource                                               |
  47. |                                          |            |                                          |          | 'aws_alb_listener.my-alb-listener'                     |
  48. |                                          |            |                                          |          | uses plain HTTP instead of HTTPS.                      |
  49. |                                          |            |                                          |          | -->tfsec.dev/docs/aws/AWS004/                          |
  50. +                                          +------------+------------------------------------------+----------+--------------------------------------------------------+
  51. |                                          |   AWS018   | Missing description for security         |   HIGH   | Resource                                               |
  52. |                                          |            | group/security group rule.               |          | 'aws_security_group_rule.my-rule' should               |
  53. |                                          |            |                                          |          | include a description for auditing                     |
  54. |                                          |            |                                          |          | purposes. -->tfsec.dev/docs/aws/AWS018/                |
  55. +                                          +------------+------------------------------------------+          +--------------------------------------------------------+
  56. |                                          |   AWS025   | API Gateway domain name uses outdated    |          | Resource                                               |
  57. |                                          |            | SSL/TLS protocols.                       |          | 'aws_api_gateway_domain_name.empty_security_policy'    |
  58. |                                          |            |                                          |          | defines outdated SSL/TLS policies (not using           |
  59. |                                          |            |                                          |          | TLS_1_2). -->tfsec.dev/docs/aws/AWS025/                |
  60. +                                          +            +                                          +          +--------------------------------------------------------+
  61. |                                          |            |                                          |          | Resource                                               |
  62. |                                          |            |                                          |          | 'aws_api_gateway_domain_name.missing_security_policy'  |
  63. |                                          |            |                                          |          | should include security_policy (defauls to outdated    |
  64. |                                          |            |                                          |          | SSL/TLS policy). -->tfsec.dev/docs/aws/AWS025/         |
  65. +                                          +            +                                          +          +--------------------------------------------------------+
  66. |                                          |            |                                          |          | Resource                                               |
  67. |                                          |            |                                          |          | 'aws_api_gateway_domain_name.outdated_security_policy' |
  68. |                                          |            |                                          |          | defines outdated SSL/TLS policies (not using TLS_1_2). |
  69. |                                          |            |                                          |          | -->tfsec.dev/docs/aws/AWS025/                          |
  70. +                                          +------------+------------------------------------------+          +--------------------------------------------------------+
  71. |                                          |   AZU003   | Unencrypted managed disk.                |          | Resource 'azurerm_managed_disk.source'                 |
  72. |                                          |            |                                          |          | defines an unencrypted managed disk.                   |
  73. |                                          |            |                                          |          | -->tfsec.dev/docs/azure/AZU003/                        |
  74. +------------------------------------------+------------+------------------------------------------+----------+--------------------------------------------------------+

You can see the config type next to each file name.

Example

  1. Dockerfile (dockerfile)
  2. =======================
  3. Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
  4. Failures: 1 (HIGH: 1, CRITICAL: 0)
  6. ...
  8. deployment.yaml (kubernetes)
  9. ============================
  10. Tests: 28 (SUCCESSES: 15, FAILURES: 13, EXCEPTIONS: 0)
  11. Failures: 13 (HIGH: 1, CRITICAL: 0)
  13. ...
  15. main.tf (terraform)
  16. ===================
  17. Tests: 23 (SUCCESSES: 14, FAILURES: 9, EXCEPTIONS: 0)
  18. Failures: 9 (HIGH: 6, CRITICAL: 1)
  20. ...
  22. bucket.yaml (cloudformation)
  23. ============================
  24. Tests: 9 (SUCCESSES: 3, FAILURES: 6, EXCEPTIONS: 0)
  25. Failures: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 4, CRITICAL: 0)

Example

See here