Merge pull request #65 from NHSDigital/CCM-9061_replaceTfsecTrivy

CCM-9061 Replace TFSec with Trivy

Author: aidenvaines-cgi

.github/actions/tfsec/action.yaml

@@ -0,0 +1,15 @@
+name: "Trivy Scan"
+runs:
+  using: "composite"
+  steps:
+    - name: "Trivy Terraform IAC Scan"
+      shell: bash
+      run: |
+        modules_exit_code=0
+
+        ./scripts/terraform/trivy.sh ./infrastructure/modules || modules_exit_code=$?
+
+        if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
+          echo "Trivy misconfigurations detected."
+          exit 1
+        fi

.github/actions/trivy/action.yaml

@@ -40,9 +40,9 @@ jobs:
           echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
           echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
           echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
-          echo "nodejs_version=$(grep "^nodejs " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
-          echo "python_version=$(grep "^python " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
-          echo "terraform_version=$(grep "^terraform " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
           echo "version=$(echo $version)" >> $GITHUB_OUTPUT
           echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
 

.github/workflows/cicd-1-pull-request.yaml

@@ -45,9 +45,9 @@ jobs:
           echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
           echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
           echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
-          echo "nodejs_version=$(grep "^nodejs " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
-          echo "python_version=$(grep "^python " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
-          echo "terraform_version=$(grep "^terraform " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
           # TODO: Get the version, but it may not be the .version file as this should come from the CI/CD Pull Request Workflow
           echo "version=$(head -n 1 .version 2> /dev/null || echo unknown)" >> $GITHUB_OUTPUT
           # echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT

.github/workflows/cicd-3-deploy.yaml

@@ -135,8 +135,8 @@ jobs:
         uses: actions/checkout@v4
       - name: "Lint Terraform"
         uses: ./.github/actions/lint-terraform
-  tfsec:
-    name: "TFSec Scan"
+  trivy:
+    name: "Trivy Scan"
     runs-on: ubuntu-latest
     timeout-minutes: 5
     needs: detect-terraform-changes
@@ -148,8 +148,8 @@ jobs:
         uses: asdf-vm/actions/setup@v3
       - name: "Perform Setup"
         uses: ./.github/actions/setup
-      - name: "TFSec Scan"
-        uses: ./.github/actions/tfsec
+      - name: "Trivy Scan"
+        uses: ./.github/actions/trivy
   count-lines-of-code:
     name: "Count lines of code"
     runs-on: ubuntu-latest

.github/workflows/stage-1-commit.yaml

@@ -1,12 +1,12 @@
 # This file is for you! Please, updated to the versions agreed by your team.
 
+gitleaks 8.18.4
+nodejs 18.18.2
+pre-commit 3.6.0
 terraform 1.9.2
 terraform-docs 0.19.0
-pre-commit 3.6.0
-nodejs 18.18.2
-gitleaks 8.18.4
-tfsec 1.28.10
 terraform-docs 0.19.0
+trivy 0.61.0
 vale 3.6.0
 
 

.tool-versions

@@ -1,4 +1,4 @@
-#tfsec:ignore:aws-iam-no-policy-wildcards
+#trivy:ignore:aws-iam-no-policy-wildcards
 data "aws_iam_policy_document" "admin" {
   policy_id = "${local.csi}-admin"
 

infrastructure/modules/kms/data_iam_kms_admin_policy.tf

@@ -1,4 +1,4 @@
-#tfsec:ignore:aws-iam-no-policy-wildcards
+#trivy:ignore:aws-iam-no-policy-wildcards
 data "aws_iam_policy_document" "user" {
   policy_id = "${local.csi}-user"
 

infrastructure/modules/kms/data_iam_kms_user_policy.tf

@@ -8,7 +8,7 @@ data "aws_iam_policy_document" "put_logs" {
       "logs:PutLogEvents",
     ]
 
-    #tfsec:ignore:aws-iam-no-policy-wildcards
+    #trivy:ignore:aws-iam-no-policy-wildcards
     resources = [
       "${aws_cloudwatch_log_group.main.arn}:*",
     ]

infrastructure/modules/lambda/data_iam_policy_document_put_logs.tf

@@ -1,4 +1,4 @@
-#tfsec:ignore:aws-s3-enable-bucket-logging Logging is a depricated attribute, use aws_s3_bucket_logging resource
+#trivy:ignore:aws-s3-enable-bucket-logging Logging is a depricated attribute, use aws_s3_bucket_logging resource
 resource "aws_s3_bucket" "main" {
   bucket        = local.csi_global
   force_destroy = var.force_destroy