8 KiB
| stage | group | info |
|---|---|---|
| Secure | Static Analysis | To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments |
Infrastructure as Code (IaC) Scanning
Introduced in GitLab 14.5.
Infrastructure as Code (IaC) Scanning scans your IaC configuration files for known vulnerabilities.
Currently, IaC scanning supports configuration files for Terraform, Ansible, AWS CloudFormation, and Kubernetes.
Requirements
IaC Scanning runs in the test stage, which is available by default. If you redefine the stages in the .gitlab-ci.yml file, the test stage is required.
To run IaC scanning jobs, by default, you need GitLab Runner with the
docker or
kubernetes executor.
If you're using the shared runners on GitLab.com, this is enabled by default.
WARNING: Our IaC scanning jobs require a Linux/amd64 container type. Windows containers are not yet supported.
WARNING:
If you use your own runners, make sure the Docker version installed
is not 19.03.0. See troubleshooting information for details.
Supported languages and frameworks
GitLab IaC scanning supports a variety of IaC configuration files. Our IaC security scanners also feature automatic language detection which works even for mixed-language projects. If any supported configuration files are detected in project source code we automatically run the appropriate IaC analyzers.
| Configuration File Type | Scan tool | Introduced in GitLab Version |
|---|---|---|
| Ansible | KICS | 14.5 |
| AWS CloudFormation | KICS | 14.5 |
| Azure Resource Manager 1 | KICS | 14.5 |
| Dockerfile | KICS | 14.5 |
| Google Deployment Manager | KICS | 14.5 |
| Kubernetes | KICS | 14.5 |
| OpenAPI | KICS | 14.5 |
| Terraform 2 | KICS | 14.5 |
- IaC scanning can analyze Azure Resource Manager templates in JSON format. If you write templates in the Bicep language, you must use the bicep CLI to convert your Bicep files into JSON before GitLab IaC scanning can analyze them.
- Terraform modules in a custom registry are not scanned for vulnerabilities. You can follow this issue for the proposed feature.
Supported distributions
GitLab scanners are provided with a base alpine image for size and maintainability.
FIPS-enabled images
Introduced in GitLab 14.10.
GitLab also offers FIPS-enabled Red Hat UBI
versions of the images. You can therefore replace standard images with FIPS-enabled
images. To configure the images, set the SAST_IMAGE_SUFFIX to -fips or modify the
standard tag plus the -fips extension.
variables:
SAST_IMAGE_SUFFIX: '-fips'
include:
- template: Jobs/SAST-IaC.gitlab-ci.yml
Making IaC analyzers available to all GitLab tiers
All open source (OSS) analyzers are available with the GitLab Free tier. Future proprietary analyzers may be restricted to higher tiers.
Summary of features per tier
Different features are available in different GitLab tiers, as shown in the following table:
| Capability | In Free & Premium | In Ultimate |
|---|---|---|
| Configure IaC scanner | {check-circle} | {check-circle} |
| Download JSON Report | {check-circle} | {check-circle} |
| See new findings in merge request widget | {dotted-circle} | {check-circle} |
| Manage vulnerabilities | {dotted-circle} | {check-circle} |
| Access the Security Dashboard | {dotted-circle} | {check-circle} |
Contribute your scanner
The Security Scanner Integration documentation explains how to integrate other security scanners into GitLab.
Configuration
To configure IaC Scanning for a project you can:
Configure IaC Scanning manually
To enable IaC Scanning you must include the
SAST-IaC.gitlab-ci.yml template provided as part of your GitLab installation. Here is an example of how to include it:
include:
- template: Jobs/SAST-IaC.gitlab-ci.yml
The included template creates IaC scanning jobs in your CI/CD pipeline and scans your project's configuration files for possible vulnerabilities.
The results are saved as a SAST report artifact that you can download and analyze.
Enable IaC Scanning via an automatic merge request
To enable IaC Scanning in a project, you can create a merge request:
- On the top bar, select Main menu > Projects and find your project.
- On the left sidebar, select Security & Compliance > Configuration.
- In the Infrastructure as Code (IaC) Scanning row, select Configure with a merge request.
- Review and merge the merge request to enable IaC Scanning.
Pipelines now include an IaC job.
Reports JSON format
The IaC tool emits a JSON report file in the existing SAST report format. For more information, see the schema for this report.
The JSON report file can be downloaded from the CI pipelines page, or the
pipelines tab on merge requests by setting artifacts: paths to gl-sast-report.json. For more information see Downloading artifacts.
Troubleshooting
IaC debug logging
To help troubleshoot IaC jobs, you can increase the Secure scanner log verbosity
by using a global CI/CD variable set to debug:
variables:
SECURE_LOG_LEVEL: "debug"
IaC Scanning findings show as No longer detected unexpectedly
If a previously detected finding unexpectedly shows as No longer detected, it might
be due to an update to the scanner. An update can disable rules that are found to
be ineffective or false positives, and the findings are marked as No longer detected:
- In GitLab 15.3, secret detection in the KICS SAST IaC scanner was disabled,
so IaC findings in the "Passwords and Secrets" family show as
No longer detected.