search

aquasecurity / trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities
Apache License 2.0
807 stars 234 forks source link

Adding support for tfvars in terraform scanning #241

Open yossigilad opened 1 year ago

yossigilad commented 1 year ago

Hi, can you please add support to specify tfvars in Terraform scanning, similar to the CLI? CLI example: trivy config . --tf-vars ./envs/xxx.tfvars

simar7 commented 1 year ago

All trivy options are available via the trivy config file, even those that are today not available as dedicated options via the trivy action.

You can read more on how to use the trivy config file here: https://aquasecurity.github.io/trivy/v0.42/docs/references/configuration/config-file/

yossigilad commented 1 year ago

@simar7 Thanks for the quick answer, but for tfvars config file is not a good option, because its dynamic for every pr. Please consider again and think that customers are having a lot of tf workspaces.

simar7 commented 1 year ago

sorry I didn't mean to close the issue, pressed the wrong button by accident.

Could you clarify what you mean by "dynamic"? today the --tf-vars flag accepts a path to a file where the terraform variables are defined. Using this from the CLI option or the trivy configuration file is no different.

yossigilad commented 1 year ago

@simar7 when using ftvars there are more then one file, and we need to spesify for every env the ftvar, and if we want to use the trivy.conf we will need to create it dynmicly with the tfvar name or create many conf files. example: image in the screen shot there are 2 tfvar files, and they can enable or dissable some of the tf code, so if we want to scan the exact vul we need to spesify the tfvar file in the trivy scan. so it will be much easier to spesify it in the action code and not use the conf file.

yossigilad commented 1 year ago

@simar7 any update?

simar7 commented 1 year ago

so it will be much easier to spesify it in the action code and not use the conf file.

I'm not sure if I understand this. Could you explain how it will be easier? CLI options and config file are identical and have the same behaviour.

yossigilad commented 1 year ago

@simar7 Think that I need to create config file for every tfvar file. The number of files will be same as workspaces ( from one to many)

simar7 commented 1 year ago

In that case, how would you be able to "dynamically" specify tf-vars when using them as a GitHub action parameter? Does GitHub allow that?

yossigilad commented 1 year ago

if you will give the option to spesify it as varibale in trivy action, I can set it with env like others action that using the tfvars (terraform apply and more)

yossigilad commented 1 year ago

@simar7 any update? or you need more information?

simar7 commented 1 year ago

We welcome a PR if you'd like to contribute.

yossigilad commented 1 year ago

Sure, I will try to create a pr

kderck commented 1 year ago

Hi. This would be great

kderck commented 1 year ago

Hi I've been working on this, However, I believe that it's currently blocked by Unable to pass tfvars file.

kderck commented 11 months ago

Hi I've opened a pull request for this: https://github.com/aquasecurity/trivy-action/pull/285 - Might need a little support with testing

kderck commented 10 months ago

This has been merged @yossigilad and @simar7 . Can this be closed?