Skip to content

Commit dbfbad9

Browse files
schosterbarakschosterbarak
authored
add IaC scan examples to docs (bridgecrewio#2259)
* add IaC scan examples * add cdk example * add k8, cdk, sam, arm examples * add kustomize to readme.md * add kustomize to readme.md
1 parent 1e29be8 commit dbfbad9

10 files changed

+1486
-3
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515

1616
**Checkov** is a static code analysis tool for infrastructure-as-code.
1717

18-
It scans cloud infrastructure provisioned using [Terraform](https://terraform.io/), Terraform plan, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io/), [Dockerfile](https://www.docker.com/), [Serverless](https://www.serverless.com/) or [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) and detects security and compliance misconfigurations using graph-based scanning.
18+
It scans cloud infrastructure provisioned using [Terraform](https://terraform.io/), [Terraform plan](docs/7.Scan%20Examples/Terraform%20Plan%20Scanning.md), [Cloudformation](docs/7.Scan%20Examples/Cloudformation.md), [AWS SAM](docs/7.Scan%20Examples/AWS%20SAM.md), [Kubernetes](docs/7.Scan%20Examples/Kubernetes.md), [Helm charts](docs/7.Scan%20Examples/Helm.md),[Kustomize](docs/7.Scan%20Examples/Kustomize.md), [Dockerfile](docs/7.Scan%20Examples/Dockerfile.md), [Serverless](docs/7.Scan%20Examples/Serverless%20Framework.md) or [ARM Templates](docs/7.Scan%20Examples/Azure%20ARM%20templates.md) and detects security and compliance misconfigurations using graph-based scanning.
1919

2020
Checkov also powers [**Bridgecrew**](https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov), the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.
2121

‎docs/7.Scan Examples/AWS SAM.md

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
layout: default
3+
published: true
4+
title: AWS SAM configuration scanning
5+
nav_order: 20
6+
---
7+
8+
# AWS SAM framework configuration scanning
9+
Checkov supports the evaluation of policies on your SAM templates files.
10+
When using checkov to scan a directory that contains a SAM template it will validate if the file is compliant with AWS best practices such as having logging and auditing enabled, making sure S3 buckets are encrypted, HTTPS is being used, and more.
11+
12+
Full list of SAM policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/serverless.html).
13+
The SAM scanning is utilizing checks that are part of the Cloudformation scanning implementation of checkov since SAM resource definition extends the Cloudformation definition.
14+
15+
### Example misconfigured SAM framework
16+
17+
```yaml
18+
AWSTemplateFormatVersion: "2010-09-09"
19+
Transform: AWS::Serverless-2016-10-31
20+
​
21+
Resources:
22+
Enabled:
23+
Type: AWS::Serverless::Api
24+
Properties:
25+
StageName: prod
26+
TracingEnabled: true
27+
CacheClusterEnabled: true
28+
AccessLogSetting:
29+
DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group'
30+
​
31+
Default:
32+
Type: AWS::Serverless::Api
33+
Properties:
34+
StageName: prod
35+
36+
37+
```
38+
### Running in CLI
39+
40+
```bash
41+
checkov -d . --framework cloudformation
42+
```
43+
44+
### Example output
45+
46+
```bash
47+
48+
_ _
49+
___| |__ ___ ___| | _______ __
50+
/ __| '_ \ / _ \/ __| |/ / _ \ \ / /
51+
| (__| | | | __/ (__| < (_) \ V /
52+
\___|_| |_|\___|\___|_|\_\___/ \_/
53+
54+
By bridgecrew.io | version: 2.0.740
55+
56+
57+
cloudformation scan results:
58+
59+
Passed checks: 3, Failed checks: 3, Skipped checks: 0
60+
61+
Check: CKV_AWS_120: "Ensure API Gateway caching is enabled"
62+
PASSED for resource: AWS::Serverless::Api.Enabled
63+
File: /sam.yaml:5-12
64+
65+
Check: CKV_AWS_73: "Ensure API Gateway has X-Ray Tracing enabled"
66+
PASSED for resource: AWS::Serverless::Api.Enabled
67+
File: /sam.yaml:5-12
68+
Guide: https://docs.bridgecrew.io/docs/logging_15
69+
70+
Check: CKV_AWS_76: "Ensure API Gateway has Access Logging enabled"
71+
PASSED for resource: AWS::Serverless::Api.Enabled
72+
File: /sam.yaml:5-12
73+
Guide: https://docs.bridgecrew.io/docs/logging_17
74+
75+
Check: CKV_AWS_120: "Ensure API Gateway caching is enabled"
76+
FAILED for resource: AWS::Serverless::Api.Default
77+
File: /sam.yaml:14-17
78+
79+
14 | Default:
80+
15 | Type: AWS::Serverless::Api
81+
16 | Properties:
82+
17 | StageName: prod
83+
84+
85+
Check: CKV_AWS_73: "Ensure API Gateway has X-Ray Tracing enabled"
86+
FAILED for resource: AWS::Serverless::Api.Default
87+
File: /sam.yaml:14-17
88+
Guide: https://docs.bridgecrew.io/docs/logging_15
89+
90+
14 | Default:
91+
15 | Type: AWS::Serverless::Api
92+
16 | Properties:
93+
17 | StageName: prod
94+
95+
96+
Check: CKV_AWS_76: "Ensure API Gateway has Access Logging enabled"
97+
FAILED for resource: AWS::Serverless::Api.Default
98+
File: /sam.yaml:14-17
99+
Guide: https://docs.bridgecrew.io/docs/logging_17
100+
101+
14 | Default:
102+
15 | Type: AWS::Serverless::Api
103+
16 | Properties:
104+
17 | StageName: prod
105+
106+
```

‎docs/7.Scan Examples/Azure ARM templates.md

+226
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
---
2+
layout: default
3+
published: true
4+
title: Azure ARM templates configuration scanning
5+
nav_order: 20
6+
---
7+
8+
# Azure ARM templates configuration scanning
9+
Checkov supports the evaluation of policies on your ARM templates files.
10+
When using checkov to scan a directory that contains a ARM templates template it will validate if the file is compliant with Azure best practices such as having logging and auditing enabled, Ensure that 'Public access level' is set to Private for blob containers , Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP), and more.
11+
12+
Full list of ARM templates policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/arm.html).
13+
14+
### Example misconfigured ARM templates
15+
16+
```json
17+
{
18+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
19+
"contentVersion": "1.0.0.0",
20+
"parameters": {
21+
"webAppName": {
22+
"type": "string",
23+
"defaultValue" : "AzureLinuxApp",
24+
"metadata": {
25+
"description": "Base name of the resource such as web app name and app service plan "
26+
},
27+
"minLength": 2
28+
},
29+
"sku":{
30+
"type": "string",
31+
"defaultValue" : "S1",
32+
"metadata": {
33+
"description": "The SKU of App Service Plan "
34+
}
35+
},
36+
"linuxFxVersion" : {
37+
"type": "string",
38+
"defaultValue" : "php|7.0",
39+
"metadata": {
40+
"description": "The Runtime stack of current web app"
41+
}
42+
},
43+
"location": {
44+
"type": "string",
45+
"defaultValue": "[resourceGroup().location]",
46+
"metadata": {
47+
"description": "Location for all resources."
48+
}
49+
}
50+
},
51+
"variables": {
52+
"webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]",
53+
"appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]"
54+
},
55+
"resources": [
56+
{
57+
"type": "Microsoft.Web/serverfarms",
58+
"apiVersion": "2018-02-01",
59+
"name": "[variables('appServicePlanName')]",
60+
"location": "[parameters('location')]",
61+
"sku": {
62+
"name": "[parameters('sku')]"
63+
},
64+
"kind": "linux",
65+
"properties":{
66+
"reserved":true
67+
}
68+
},
69+
{
70+
"type": "Microsoft.Web/sites",
71+
"apiVersion": "2018-11-01",
72+
"name": "[variables('webAppPortalName')]",
73+
"location": "[parameters('location')]",
74+
"kind": "app",
75+
"dependsOn": [
76+
"[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
77+
],
78+
"properties": {
79+
"serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
80+
"siteConfig": {
81+
"linuxFxVersion": "[parameters('linuxFxVersion')]"
82+
}
83+
}
84+
}
85+
]
86+
}
87+
88+
89+
```
90+
### Running in CLI
91+
92+
```bash
93+
checkov -d . --framework arm
94+
```
95+
96+
### Example output
97+
98+
```bash
99+
_ _
100+
___| |__ ___ ___| | _______ __
101+
/ __| '_ \ / _ \/ __| |/ / _ \ \ / /
102+
| (__| | | | __/ (__| < (_) \ V /
103+
\___|_| |_|\___|\___|_|\_\___/ \_/
104+
105+
By bridgecrew.io | version: 2.0.723
106+
107+
arm scan results:
108+
109+
Passed checks: 0, Failed checks: 5, Skipped checks: 0
110+
111+
Check: CKV_AZURE_15: "Ensure web app is using the latest version of TLS encryption"
112+
FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')]
113+
File: /example.json:53-68
114+
Guide: https://docs.bridgecrew.io/docs/bc_azr_networking_6
115+
116+
53 | {
117+
54 | "type": "Microsoft.Web/sites",
118+
55 | "apiVersion": "2018-11-01",
119+
56 | "name": "[variables('webAppPortalName')]",
120+
57 | "location": "[parameters('location')]",
121+
58 | "kind": "app",
122+
59 | "dependsOn": [
123+
60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
124+
61 | ],
125+
62 | "properties": {
126+
63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
127+
64 | "siteConfig": {
128+
65 | "linuxFxVersion": "[parameters('linuxFxVersion')]"
129+
66 | }
130+
67 | }
131+
68 | }
132+
133+
134+
Check: CKV_AZURE_17: "Ensure the web app has 'Client Certificates (Incoming client certificates)' set"
135+
FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')]
136+
File: /example.json:53-68
137+
Guide: https://docs.bridgecrew.io/docs/bc_azr_networking_7
138+
139+
53 | {
140+
54 | "type": "Microsoft.Web/sites",
141+
55 | "apiVersion": "2018-11-01",
142+
56 | "name": "[variables('webAppPortalName')]",
143+
57 | "location": "[parameters('location')]",
144+
58 | "kind": "app",
145+
59 | "dependsOn": [
146+
60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
147+
61 | ],
148+
62 | "properties": {
149+
63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
150+
64 | "siteConfig": {
151+
65 | "linuxFxVersion": "[parameters('linuxFxVersion')]"
152+
66 | }
153+
67 | }
154+
68 | }
155+
156+
157+
Check: CKV_AZURE_14: "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service"
158+
FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')]
159+
File: /example.json:53-68
160+
Guide: https://docs.bridgecrew.io/docs/bc_azr_networking_5
161+
162+
53 | {
163+
54 | "type": "Microsoft.Web/sites",
164+
55 | "apiVersion": "2018-11-01",
165+
56 | "name": "[variables('webAppPortalName')]",
166+
57 | "location": "[parameters('location')]",
167+
58 | "kind": "app",
168+
59 | "dependsOn": [
169+
60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
170+
61 | ],
171+
62 | "properties": {
172+
63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
173+
64 | "siteConfig": {
174+
65 | "linuxFxVersion": "[parameters('linuxFxVersion')]"
175+
66 | }
176+
67 | }
177+
68 | }
178+
179+
180+
Check: CKV_AZURE_16: "Ensure that Register with Azure Active Directory is enabled on App Service"
181+
FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')]
182+
File: /example.json:53-68
183+
Guide: https://docs.bridgecrew.io/docs/bc_azr_iam_1
184+
185+
53 | {
186+
54 | "type": "Microsoft.Web/sites",
187+
55 | "apiVersion": "2018-11-01",
188+
56 | "name": "[variables('webAppPortalName')]",
189+
57 | "location": "[parameters('location')]",
190+
58 | "kind": "app",
191+
59 | "dependsOn": [
192+
60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
193+
61 | ],
194+
62 | "properties": {
195+
63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
196+
64 | "siteConfig": {
197+
65 | "linuxFxVersion": "[parameters('linuxFxVersion')]"
198+
66 | }
199+
67 | }
200+
68 | }
201+
202+
203+
Check: CKV_AZURE_18: "Ensure that 'HTTP Version' is the latest if used to run the web app"
204+
FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')]
205+
File: /example.json:53-68
206+
Guide: https://docs.bridgecrew.io/docs/bc_azr_networking_8
207+
208+
53 | {
209+
54 | "type": "Microsoft.Web/sites",
210+
55 | "apiVersion": "2018-11-01",
211+
56 | "name": "[variables('webAppPortalName')]",
212+
57 | "location": "[parameters('location')]",
213+
58 | "kind": "app",
214+
59 | "dependsOn": [
215+
60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
216+
61 | ],
217+
62 | "properties": {
218+
63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
219+
64 | "siteConfig": {
220+
65 | "linuxFxVersion": "[parameters('linuxFxVersion')]"
221+
66 | }
222+
67 | }
223+
68 | }
224+
225+
226+
```

0 commit comments

Comments
 (0)