github.com/ishita82/trivy-gitaction@v0.0.0-20240206054925-e937cc05f8e3/docs/tutorials/misconfiguration/terraform.md (about)

     1  # Scanning Terraform files with Trivy
     2  
     3  This tutorial is focused on ways Trivy can scan Terraform IaC configuration files. 
     4  
     5  A video tutorial on Terraform Misconfiguration scans can be found on the [Aqua Open Source YouTube account.](https://youtu.be/BWp5JLXkbBc)
     6  
     7  **A note to tfsec users** 
     8  We have been consolidating all of our scanning-related efforts in one place, and that is Trivy. You can read more on the decision in the [tfsec discussions.](https://github.com/aquasecurity/tfsec/discussions/1994)
     9  
    10  ## Trivy Config Command 
    11  
    12  Terraform configuration scanning is available as part of the `trivy config` command. This command scans all configuration files for misconfiguration issues. You can find the details within [misconfiguration scans in the Trivy documentation.](https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/) 
    13  
    14  Command structure: 
    15  ``` 
    16  trivy config <any flags you want to use> <file or directory that you would like to scan> 
    17  ``` 
    18  
    19  The `trivy config` command can scan Terraform configuration, CloudFormation, Dockerfile, Kubernetes manifests, and Helm Charts for misconfiguration. Trivy will compare the configuration found in the file with a set of best practices.  
    20  
    21  - If the configuration is following best practices, the check will pass,  
    22  - If the configuration does not define the resource of some configuration, Trivy will assume the default configuration for the resource creation is used. In this case, the check might fail.
    23  - If the configuration that has been defined does not follow best practices, the check will fail.  
    24  
    25  ### Prerequisites 
    26  Install Trivy on your local machines. The documentation provides several [different installation options.](https://aquasecurity.github.io/trivy/latest/getting-started/installation/) 
    27  This tutorial will use this example [Terraform tutorial](https://github.com/Cloud-Native-Security/trivy-demo/tree/main/bad_iac/terraform) for terraform misconfiguration scanning with Trivy. 
    28  
    29  Git clone the tutorial and cd into the directory: 
    30  ``` 
    31  git clone git@github.com:Cloud-Native-Security/trivy-demo.git
    32  cd bad_iac/terraform
    33  ``` 
    34  In this case, the folder only containes Terraform configuration files. However, you could scan a directory that contains several different configurations e.g. Kubernetes YAML manifests, Dockerfile, and Terraform. Trivy will then detect the different configuration files and apply the right rules automatically. 
    35  
    36  ## Different types of `trivy config` scans 
    37  
    38  Below are several examples of how the trivy config scan can be used. 
    39  
    40  General Terraform scan with trivy: 
    41  ``` 
    42  trivy config <specify the directory> 
    43  ``` 
    44  
    45  So if we are already in the directory that we want to scan: 
    46  ``` 
    47  trivy config ./ 
    48  ``` 
    49  ### Specify the scan format 
    50  The `--format` flag changes the way that Trivy displays the scan result: 
    51  
    52  JSON: 
    53  ```
    54  trivy config -f json terraform-infra 
    55  ``` 
    56  
    57  Sarif: 
    58  ``` 
    59  trivy config -f sarif terraform-infra 
    60  ``` 
    61  
    62  ### Specifying the output location 
    63  
    64  The `--output` flag specifies the file location in which the scan result should be saved: 
    65  
    66  JSON: 
    67  ``` 
    68  trivy config -f json -o example.json terraform-infra 
    69  ``` 
    70  
    71  Sarif: 
    72  ``` 
    73  trivy config -f sarif -o example.sarif terraform-infra 
    74  ``` 
    75  
    76  ### Filtering by severity 
    77  
    78  If you are presented with lots and lots of misconfiguration across different files, you might want to filter or the misconfiguration with the highest severity: 
    79  
    80  ``` 
    81  trivy config --severity CRITICAL, MEDIUM terraform-infra 
    82  ``` 
    83  
    84  ### Passing tf.tfvars files into `trivy config` scans 
    85  
    86  You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided [in the documentation.](https://aquasecurity.github.io/trivy/latest/docs/coverage/iac/terraform/#value-overrides) 
    87  
    88  ``` 
    89  trivy conf --tf-vars terraform.tfvars ./
    90  ``` 
    91  ### Custom Checks 
    92  
    93  We have lots of examples in the [documentation](https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/custom/) on how you can write and pass custom Rego policies into terraform misconfiguration scans. 
    94  
    95  ## Secret and vulnerability scans
    96  
    97  The `trivy config` command does not perform secrete and vulnerability checks out of the box. However, you can specify as part of your `trivy fs` scan that you would like to scan you terraform files for exposed secrets and misconfiguraction through the following flags: 
    98  
    99  ```
   100  trivy fs --scanners secret,misconfig ./
   101  ```
   102  
   103  The `trivy config` command is a sub-command of the `trivy fs` command. You can learn more about this command in the [documentation.](https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/) 
   104  
   105  ## Scanning Terraform Plan files
   106  
   107  Instead of scanning your different Terraform resources individually, you could also scan your terraform plan output before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. [Here](https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/custom/examples/#terraform-plan) is the link to the documentation.
   108  
   109  First, create a terraform plan and save it to a file:
   110  ```
   111  terraform plan --out tfplan.binary
   112  ```
   113  
   114  Next, convert the file into json format:
   115  ```
   116  terraform show -json tfplan.binary > tfplan.json
   117  ```
   118  
   119  Lastly, scan the file with the `trivy config` command:
   120  ```
   121  trivy config ./tfplan.json
   122  ```
   123  
   124  Note that you need to be able to create a terraform init and plan without any errors. 
   125  
   126  ## Using Trivy in your CI/CD pipeline 
   127  Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: [https://aquasecurity.github.io/trivy/latest/tutorials/integrations/](https://aquasecurity.github.io/trivy/latest/tutorials/integrations/) 
   128  
   129