atlassian/bitbucket-iac-scanScans Infrastructure as Code files for security misconfigurations and vulnerabilities using KICS, with Bitbucket Code Insights reporting.
Scans your Infrastructure as Code configuration files to ensure good security practises. Creates a security Code Insights report if issue is found.
This Bitbucket Cloud supported Pipe leverages the industry leading KICS scanning tool to provide IaC Scanning capabilities to Bitbucket customers. See Details and Examples section for more information.
Add the following snippet to the script section of your bitbucket-pipelines.yml file:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: '<string>'
# SCAN_EXTRA_ARGS: '<array>' # Optional.
# CONFIG_PATH: '<string>' # Optional.
# CREATE_REPORT: "<boolean>" # Optional. Default: `true`
# FAIL_ON: "<integer>" # Optional.
# DEBUG: "<boolean>" # Optional. Default: `false`
| Variable | Usage |
|---|---|
| FILES_TO_SCAN_PATH (*) | Files or directories to scan , separated. Example: "./path_to_dir,path_to_file.txt". |
| SCAN_EXTRA_ARGS | Additional options to pass to the KICS scan commands. If -p argument is passed, it will extend the files or directories provided in FILES_TO_SCAN_PATH variable. If --config argument is passed, it will be ignored in favour of the CONFIG_PATH variable. |
| CONFIG_PATH | Path to KICS configuration file. Alternative to SCAN_EXTRA_ARGS variable. If path keyword is provided inside config file, it will be ignored in favour of the FILES_TO_SCAN_PATH variable. |
| CREATE_REPORT | Controls whether the pipe will create Bitbucket CodeInsights reports using the results of the KICS execution. Default: true. |
| FAIL_ON | The threshold value of the KICS scanner's [result status code][result status code] at which the pipe should trigger a failure. |
| DEBUG | Turn on extra debug information. Default: false. |
(*) = required variable.
If necessary, users can enhance their scans by incorporating options from the Scan command with the SCAN_EXTRA_ARGS variable.
Additionally, there's an option for users to create and provide a custom KICS configuration file, which is applied in the bitbucket-iac-scan pipe through the CONFIG_PATH variable. This configuration file serves as an alternative to using SCAN_EXTRA_ARGS.
Upon creating a custom KICS config, it should be stored within the user's repository. This is where the pipeline with a bitbucket-iac-scan pipe will be triggered.
If both SCAN_EXTRA_ARGS and CONFIG_PATH variables are provided with duplicated arguments, then arguments from SCAN_EXTRA_ARGS variable will have a higher precedence.
script:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: ./my_files_to_scan_dir
Scan the sources and pipe should fail if the KICS scanner's [result status code][result status code] is more than or equal to provided threshold value.
script:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: ./my_files_to_scan_dir
FAIL_ON: 40
Example with kics config that can be used in the pipe:
kics-config.json. The path key will be ignored
{
"path": "assets/iac_samples",
"verbose": true,
"log-file": true,
"type": "Dockerfile,Kubernetes",
"queries-path": "assets/queries",
"exclude-paths": [
"foo/",
"bar/"
],
"output-path": "results"
}
script:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: ./my_files_to_scan_dir
CONFIG_PATH: kics-config.json
Example with scan options:
script:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: ./my_files_to_scan_dir
SCAN_EXTRA_ARGS:
- "--disable-secrets"
- "--type=Dockerfile"
Do not create a CodeInsights report:
script:
- pipe: atlassian/bitbucket-iac-scan:0.5.2
variables:
FILES_TO_SCAN_PATH: ./my_files_to_scan_dir
CREATE_REPORT: 'false'
If you’d like help with this pipe, or you have an issue or feature request, let us know on Community.
If you’re reporting an issue, please include:
Copyright (c) 2024 Atlassian and others. Apache 2.0 licensed, see LICENSE.txt file.