Okay,
I'm back here in Visual Studio Code, and I've reverted the changes
that I talked about in the last video because I want them to show up
on the GitHub action when I run the check.
So, actually, let's go here under the .github/workflows folder,
there's a configuration file here called terrascan.yml, and I'll leave a
link to this in the README as well, but this is the Terrascan GitHub
action with a few different options specified.
I've got my iac_type, or Infrastructure as Code typeset as Terraform, and
I'm looking at AWS policies. The only_warn flag here on line 17 will mean
that the job will pass even if there are errors detected. And then,
there's another one at the bottom, serif_upload, on line 18, which is
followed up by a Upload SARIF file GitHub action. And I'll go into a
little bit more detail about that in just a moment, but you can get a full
list of each of the flags that you can run on this option on the GitHub
Actions page for it. Like I said, I'll leave a note to that in the README
file. For now, let's go over to GitHub and watch it run.
I'll pause the video here and open up the new page.
So this is the GitHub repository for the demo code I'm using, and
I'll go ahead and tab over to Actions, and you see it's already run
once because I did push to this branch when I first set up the
repository, and I have the action set up to scan on push. But I can
go over here to the action and then I will click Re‑run all jobs so
we can see it again.
Now this is going to essentially download Terrascan in a Docker container,
and then run it against the code in this repository.
So we'll pause the video here for a minute and then
resume it when the scan is done.
All right, so you see now the scan has run, its finished green, and I want to
go over a few things first. Number one, if we go over to the Run Terrascan,
this is actually showing you the policy violations that we saw in the previous
demo, and it's showing you the commands that it's running too. So this is just
running the terrascan scan command with a few different flags in a container,
like I said earlier.
Next, actually, is the Upload SARIF file, which, if you remember, we
had this flag enabled on the Terrascan action and that generated a
SARIF file called terrascan.sarif, and then uploaded the results to
GitHub. So what does that mean for us? So, if I go up here to my GitHub
repository and then go over to Security, you'll see I've got some code
scanning alerts here on the left‑hand side that weren't there a minute
ago.
And GitHub has this feature where if you have a public
repository or GitHub enterprise, then you can upload a SARIF
file if any security vulnerabilities are detected, and it will
open up new security issues for each.
So you'll see I've got the same two issues that we had earlier, the S3
versioning, which is marked as an error here because it was a high priority
in Terrascan, and the access logging, which is a warning because it was a
medium priority error in Terrascan. So, I can open this up and I'll see this
is the rule it's violating and this is the line it was detected on in my
repository. And from here, I can even create a new issue, so let's create an
issue here.
I want to fix my access logging,
I'll submit the new issue for now, and now I can start
work on fixing that issue in my code.
So this is how you can use Terrascan as a GitHub action in order to
automatically flag and mark issues in your infrastructure configuration.
And then from here, you can set out on whatever your organization's
process is to check in new code to resolve those issues.
I've got two other configurations for Terrascan I want to show you,
but let's go ahead and do that in the next video.
I'll see you there.