tfsec is joining the Trivy family #1994
Replies: 7 comments 19 replies
-
|
What are the steps to transition from tfsec to trivy? I did: |
Beta Was this translation helpful? Give feedback.
-
|
looks like you're looking at an older version of the doc. this is the latest release https://aquasecurity.github.io/trivy/v0.37/docs/misconfiguration/scanning/ trivy does support tfvars but does not show statistics counts as tfsec by design. |
Beta Was this translation helpful? Give feedback.
-
|
I noticed that trivy supports tfvars files with the --tf-vars option. Is there a way to set this in a configuration file? I'm running into issues making this work with pre-commit. So far, I have been unable to get trivy to scan using my tfvars file. |
Beta Was this translation helpful? Give feedback.
-
|
@cpflugfelder please ask this question in the Trivy repository so the team can answer |
Beta Was this translation helpful? Give feedback.
-
|
We are using tfsec marketplace task : https://marketplace.visualstudio.com/items?itemName=tfsec.tfsec |
Beta Was this translation helpful? Give feedback.
-
|
Hi, can you please clarify:
|
Beta Was this translation helpful? Give feedback.
-
|
@itaysk I am happy with tfsec after a quick testing and comparing with trivy's extension. Blockers with trivy extension
Are that above known issues? Please suggest if I missed anything during testing with trivy. I like following with trivy that are better than tfsec
Do you think tfsec is better tool in our case? Do you think tfsec is better tool in our case? |
Beta Was this translation helpful? Give feedback.
-
|
hello @AshishDadhich4h2 - could you confirm what Trivy extension are you using that had those blockers? |
Beta Was this translation helpful? Give feedback.
-
|
@simar7 we are using following ado extension: |
Beta Was this translation helpful? Give feedback.
-
|
@giorod3 since you had cut the last release, would you know if the above are supported? |
Beta Was this translation helpful? Give feedback.
-
|
Is there a migration path for aquasecurity/tfsec-pr-commenter-action? |
Beta Was this translation helpful? Give feedback.
-
|
This is the action where I saw the message to come to this discussion. It doesn't appear to have improved much since it was announced a year or two ago now. How is everyone doing? |
Beta Was this translation helpful? Give feedback.
-
|
Is there any documentation on how I found this page but I didn't see anything about comments https://github.com/aquasecurity/tfsec/blob/master/tfsec-to-trivy-migration-guide.md |
Beta Was this translation helpful? Give feedback.
-
|
You can find that documented here https://aquasecurity.github.io/trivy/v0.43/docs/configuration/filtering/ |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for that. Is it only possible to filter by the ID? I think filtering by name as is done currently in tfsec has more utility as the ID on its own does not mean anything and requires an additional accompanying comment https://aquasecurity.github.io/trivy/v0.43/docs/configuration/filtering/#by-inline-comments |
Beta Was this translation helpful? Give feedback.
-
|
Trivy does seem to honour existing tfsec comments, although I agree the names are easier to work with. |
Beta Was this translation helpful? Give feedback.
-
|
Is there more advanced documentation regarding the migration tfsec custom checks to trivy policies (repo policies)? I tried converting a simple custom check without any success: ---
checks:
- code: missing-default-tags
description: Custom check to ensure default tags are set on AWS Providers
requiredTypes:
- provider
requiredLabels:
- aws
severity: MEDIUM
matchSpec:
name: default_tags
action: isPresent
subMatch:
action: and
predicateMatchSpec:
- action: contains
name: tags
value: TAG_1
- action: contains
name: tags
value: TAG_2
errorMessage: |
The missing tags helps structure .....From what I see in the code when initialising the repo scanner, the terraform always sets the source to cloud (rego is initialized with source rego): regoScanner := rego.NewScanner(types.SourceCloud, s.options...)
regoScanner.SetParentDebugLogger(s.debug)Also before applying the rego rules, an adapt is applied: adaptationTime := time.Now()
infra := adapter.Adapt(modules)
metrics.Timings.Adaptation = time.Since(adaptationTime)
e.debug.Log("Adapted %d module(s) into defsec state data.", len(modules))And at this point seems that we're bounded to what we can get, and it doesn't seem possible to actually validate default tags. |
Beta Was this translation helpful? Give feedback.
-
@DBirth - can you share your converted rego policy? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @simar7 , # METADATA
# title: "Mandatory default tags"
# description: "Tags are mandatory for all projects"
# scope: package
# custom:
# id: CUSTOM-AWS-001
# severity: LOW
# short_code: missing_mandatory_tags
# recommended_action: "Ensure that tags [TAG_1, TAG_2] exist"
package user.terraform. missing_mandatory_tags
deny[res] {
trace(sprintf("Check input object! %v", [input]))
1 == 1
msg := "Checking rego input to implement next steps"
res := result.new(msg, input.aws.config)
}But in the json returned by the trace I couldn't see a way to get the provider. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry but could you help me understand what are you trying to check? In Trivy we have the concept of providers (like AWS) that have services (like EC2, RDS, etc.) which further have attributes to them that can be scanned for. For example take a look at the definition of an RDS instance https://github.com/aquasecurity/defsec/blob/v0.93.1/pkg/providers/aws/rds/rds.go based on this we can write such a rego policy https://github.com/aquasecurity/defsec/blob/v0.93.1/rules/cloud/policies/aws/rds/disable_cluster_skip_final_snapshot.rego |
Beta Was this translation helpful? Give feedback.
-
|
So basically I want to validate the arguments at the provider level, for example: provider "aws" {
region = "eu-west-1"
default_tags {
tags = {
"TAG": "VALUE"
}
}
}Here I would like to set a custom check that enforces that the only allowed region is As you stated, trivy has the concept of providers and for AWS the model (input) is https://github.com/aquasecurity/defsec/blob/v0.93.1/pkg/providers/aws/aws.go. But there's nothing that allows me to validate the provider block from what I can see, trivy only has mappings for the individual resources. But the general ones like for |
Beta Was this translation helpful? Give feedback.
-
|
@DBirth you're right we don't have support for that today. I've cut aquasecurity/trivy#5459 to track adding this. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, what about trivy with pre-commit as replacement of tfsec? |
Beta Was this translation helpful? Give feedback.
-
|
It is not an Aqua open source maintained project so we can't comment on it. |
Beta Was this translation helpful? Give feedback.
-
|
Here is an open issue and open PR for approval if Aqua want tfsec people start moving to Trivy. thank you! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations scanning capabilities, including Terraform scanning, which has been natively supported in Trivy for a long time now.
Going forward we want to encourage the tfsec community to transition over to Trivy. Moving to Trivy gives you the same excellent Terraform scanning engine, with some extra benefits:
tfsec will continue to remain available for the time being, although our engineering attention will be directed at Trivy going forward.
Beta Was this translation helpful? Give feedback.
All reactions