search

azsk / DevOpsKit-docs

MIT License
496 stars 208 forks source link

AzSK on YAML #379

Open adrianaeguzman opened 3 years ago

adrianaeguzman commented 3 years ago

I have been struggling to implement (and even first run) the Azure Security Kit on my recently migrated to YAML ARM templates. Anyone got a clue on how it could work? I want to start by implementing it on just the CI part.

I already have my YAML snippet from the "view YAML" part on the classic deployment and also a .csv with some example logs I have been trying to "skip" on the skipControlsFromFile part but every time I run my pipeline it just all comes out as validated and no logs file from this.

Also, I have been trying to run the scan from Powershell but I get several error messages from that.

Would be nice to have some feedback if anyone else is trying this as well :)

ritika-msft commented 3 years ago

Hi adrianaeguzman,

It would be helpful if you can share the error messages that you are getting while running AzSK scans from PowerShell.

For skipControlsFromFile, please follow the steps mentioned at https://github.com/azsk/DevOpsKit-docs/blob/master/03-Security-In-CICD/Readme.md#skip-certain-controls-during-scan and see if these steps help to resolve the issue.

If you still face any issue, let us know.

Thanks, Ritika