mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-19 05:59:40 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,238 @@
|
||||
---
|
||||
name: implementing-aqua-security-for-container-scanning
|
||||
description: Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
|
||||
domain: cybersecurity
|
||||
subdomain: devsecops
|
||||
tags: [aqua-security, trivy, container-scanning, vulnerability-scanning, sbom, image-security, supply-chain]
|
||||
version: "1.0"
|
||||
author: mahipal
|
||||
license: MIT
|
||||
---
|
||||
|
||||
# Implementing Aqua Security for Container Scanning
|
||||
|
||||
## Overview
|
||||
|
||||
Aqua Security provides Trivy, the world's most popular open-source universal security scanner, designed to find vulnerabilities, misconfigurations, secrets, SBOM data, and license issues in containers, Kubernetes, code repositories, and cloud environments. Trivy covers OS packages (Alpine, Debian, Ubuntu, RHEL, etc.) and language-specific dependencies (npm, pip, Maven, Go modules, Cargo, etc.) with vulnerability databases sourced from NVD, vendor advisories, and GitHub Security Advisories. The enterprise Aqua Platform extends Trivy with centralized policy management, runtime protection, and compliance reporting.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Docker installed for local image scanning
|
||||
- CI/CD platform (GitHub Actions, GitLab CI, Jenkins, etc.)
|
||||
- Container registry access (Docker Hub, ECR, GCR, ACR, Harbor)
|
||||
- Trivy CLI (`trivy`) or Trivy Operator for Kubernetes
|
||||
- Aqua Platform license for enterprise features (optional)
|
||||
|
||||
## Core Scanning Capabilities
|
||||
|
||||
### Image Vulnerability Scanning
|
||||
|
||||
Trivy scans container images layer by layer, identifying CVEs in OS packages and application dependencies. It supports scanning local images, remote registry images, and tar archives.
|
||||
|
||||
```bash
|
||||
# Scan a remote image
|
||||
trivy image python:3.11-slim
|
||||
|
||||
# Scan with severity filter
|
||||
trivy image --severity HIGH,CRITICAL nginx:latest
|
||||
|
||||
# Scan and fail CI if critical CVEs found
|
||||
trivy image --exit-code 1 --severity CRITICAL myapp:latest
|
||||
|
||||
# Generate SBOM in CycloneDX format
|
||||
trivy image --format cyclonedx --output sbom.json myapp:latest
|
||||
```
|
||||
|
||||
### Filesystem and Repository Scanning
|
||||
|
||||
```bash
|
||||
# Scan project directory for vulnerabilities in dependencies
|
||||
trivy fs --scanners vuln,secret,misconfig .
|
||||
|
||||
# Scan a specific lockfile
|
||||
trivy fs --scanners vuln package-lock.json
|
||||
|
||||
# Scan git repository
|
||||
trivy repo https://github.com/org/project
|
||||
```
|
||||
|
||||
### Kubernetes Scanning with Trivy Operator
|
||||
|
||||
The Trivy Operator runs inside a Kubernetes cluster and continuously scans workloads:
|
||||
|
||||
```bash
|
||||
# Install Trivy Operator via Helm
|
||||
helm repo add aqua https://aquasecurity.github.io/helm-charts/
|
||||
helm repo update
|
||||
helm install trivy-operator aqua/trivy-operator \
|
||||
--namespace trivy-system \
|
||||
--create-namespace \
|
||||
--set trivy.severity="HIGH,CRITICAL" \
|
||||
--set operator.scanJobTimeout="5m"
|
||||
```
|
||||
|
||||
The operator creates VulnerabilityReport and ConfigAuditReport custom resources for each workload.
|
||||
|
||||
### IaC Misconfiguration Scanning
|
||||
|
||||
```bash
|
||||
# Scan Terraform files
|
||||
trivy config --severity HIGH,CRITICAL ./terraform/
|
||||
|
||||
# Scan Dockerfile for misconfigurations
|
||||
trivy config Dockerfile
|
||||
|
||||
# Scan Kubernetes manifests
|
||||
trivy config ./k8s-manifests/
|
||||
```
|
||||
|
||||
## CI/CD Integration
|
||||
|
||||
### GitHub Actions
|
||||
|
||||
```yaml
|
||||
name: Container Security Scan
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
scan:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Build Docker image
|
||||
run: docker build -t myapp:${{ github.sha }} .
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'myapp:${{ github.sha }}'
|
||||
format: 'sarif'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1'
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
if: always()
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
### GitLab CI
|
||||
|
||||
```yaml
|
||||
container_scanning:
|
||||
stage: security
|
||||
image:
|
||||
name: aquasec/trivy:latest
|
||||
entrypoint: [""]
|
||||
variables:
|
||||
FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
|
||||
script:
|
||||
- trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl"
|
||||
--output gl-container-scanning-report.json $FULL_IMAGE_NAME
|
||||
- trivy image --exit-code 1 --severity CRITICAL $FULL_IMAGE_NAME
|
||||
artifacts:
|
||||
reports:
|
||||
container_scanning: gl-container-scanning-report.json
|
||||
```
|
||||
|
||||
### Jenkins Pipeline
|
||||
|
||||
```groovy
|
||||
pipeline {
|
||||
agent any
|
||||
stages {
|
||||
stage('Build') {
|
||||
steps {
|
||||
sh 'docker build -t myapp:${BUILD_NUMBER} .'
|
||||
}
|
||||
}
|
||||
stage('Security Scan') {
|
||||
steps {
|
||||
sh '''
|
||||
trivy image --exit-code 1 \
|
||||
--severity HIGH,CRITICAL \
|
||||
--format json \
|
||||
--output trivy-report.json \
|
||||
myapp:${BUILD_NUMBER}
|
||||
'''
|
||||
}
|
||||
post {
|
||||
always {
|
||||
archiveArtifacts artifacts: 'trivy-report.json'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Policy Configuration
|
||||
|
||||
### Trivy Policy with OPA/Rego
|
||||
|
||||
Create `.trivy/policy.rego` for custom policy enforcement:
|
||||
|
||||
```rego
|
||||
package trivy
|
||||
|
||||
deny[msg] {
|
||||
input.Results[_].Vulnerabilities[_].Severity == "CRITICAL"
|
||||
msg := "Critical vulnerabilities found in image"
|
||||
}
|
||||
|
||||
deny[msg] {
|
||||
input.Results[_].Vulnerabilities[vuln]
|
||||
vuln.FixedVersion != ""
|
||||
vuln.Severity == "HIGH"
|
||||
msg := sprintf("Fixable HIGH vulnerability: %s", [vuln.VulnerabilityID])
|
||||
}
|
||||
```
|
||||
|
||||
### Ignore File Configuration
|
||||
|
||||
Create `.trivyignore` for accepted risks:
|
||||
|
||||
```
|
||||
# Accepted risk: vulnerability in test dependency only
|
||||
CVE-2023-12345
|
||||
|
||||
# Accepted until expiry date
|
||||
CVE-2024-67890 exp:2025-06-01
|
||||
```
|
||||
|
||||
## SBOM Generation and Management
|
||||
|
||||
```bash
|
||||
# Generate CycloneDX SBOM
|
||||
trivy image --format cyclonedx --output sbom-cyclonedx.json myapp:latest
|
||||
|
||||
# Generate SPDX SBOM
|
||||
trivy image --format spdx-json --output sbom-spdx.json myapp:latest
|
||||
|
||||
# Scan an existing SBOM for new vulnerabilities
|
||||
trivy sbom sbom-cyclonedx.json
|
||||
```
|
||||
|
||||
## Monitoring and Reporting
|
||||
|
||||
| Metric | Description | Target |
|
||||
|--------|-------------|--------|
|
||||
| Images scanned per day | Total images passing through scanning pipeline | All production images |
|
||||
| Critical CVE count | Open critical vulnerabilities across all images | 0 in production |
|
||||
| Mean time to patch | Average days from CVE publication to patched image | < 7 days |
|
||||
| SBOM coverage | Percentage of production images with generated SBOMs | 100% |
|
||||
| Scan duration | Average time per image scan | < 2 minutes |
|
||||
|
||||
## References
|
||||
|
||||
- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
|
||||
- [Trivy GitHub Repository](https://github.com/aquasecurity/trivy)
|
||||
- [Trivy Operator for Kubernetes](https://aquasecurity.github.io/trivy-operator/)
|
||||
- [Aqua Security Platform](https://www.aquasec.com/products/)
|
||||
- [CycloneDX SBOM Specification](https://cyclonedx.org/specification/overview/)
|
||||
@@ -0,0 +1,27 @@
|
||||
# Container Scanning Implementation Template
|
||||
|
||||
## Image Registry Scanning Configuration
|
||||
|
||||
| Registry | URL | Auth Method | Auto-scan | Schedule |
|
||||
|----------|-----|-------------|-----------|----------|
|
||||
| | | | [ ] Yes | |
|
||||
|
||||
## Severity Threshold Policy
|
||||
|
||||
| Environment | Block Critical | Block High | Block Medium | Block Unfixable |
|
||||
|-------------|---------------|------------|--------------|-----------------|
|
||||
| Development | [ ] | [ ] | [ ] | [ ] |
|
||||
| Staging | [x] | [ ] | [ ] | [ ] |
|
||||
| Production | [x] | [x] | [ ] | [ ] |
|
||||
|
||||
## Accepted Risk Register (.trivyignore)
|
||||
|
||||
| CVE ID | Package | Reason | Accepted By | Expiry Date |
|
||||
|--------|---------|--------|-------------|-------------|
|
||||
| | | | | |
|
||||
|
||||
## SBOM Tracking
|
||||
|
||||
| Image | SBOM Format | Storage Location | Last Generated |
|
||||
|-------|-------------|------------------|----------------|
|
||||
| | [ ] CycloneDX [ ] SPDX | | |
|
||||
@@ -0,0 +1,34 @@
|
||||
# Standards Reference for Container Scanning
|
||||
|
||||
## NIST SP 800-190: Application Container Security Guide
|
||||
|
||||
| Recommendation | Trivy Coverage |
|
||||
|---------------|---------------|
|
||||
| 4.1 Image vulnerabilities | CVE scanning of OS packages and app dependencies |
|
||||
| 4.2 Image configuration defects | IaC misconfig scanning of Dockerfiles |
|
||||
| 4.3 Embedded malware | Secret scanning detects embedded credentials |
|
||||
| 4.4 Embedded cleartext secrets | Secret scanner with regex and entropy detection |
|
||||
| 4.5 Use of untrusted images | Registry scanning and image provenance verification |
|
||||
|
||||
## CIS Docker Benchmark v1.6 Alignment
|
||||
|
||||
| CIS Control | Trivy Check |
|
||||
|-------------|-------------|
|
||||
| 4.1 Ensure image is created from a trusted base | Base image vulnerability scanning |
|
||||
| 4.3 Ensure unnecessary packages are not installed | SBOM generation reveals full package inventory |
|
||||
| 4.6 Add HEALTHCHECK instruction | Dockerfile misconfiguration check |
|
||||
| 4.9 Ensure COPY instead of ADD | Dockerfile misconfiguration check |
|
||||
| 4.10 Ensure secrets are not stored in Dockerfiles | Secret detection in filesystem scan |
|
||||
|
||||
## Vulnerability Database Sources
|
||||
|
||||
| Source | Coverage | Update Frequency |
|
||||
|--------|----------|------------------|
|
||||
| NVD (NIST) | All CVEs | Continuous |
|
||||
| Alpine SecDB | Alpine Linux packages | Daily |
|
||||
| Debian Security Tracker | Debian packages | Daily |
|
||||
| Ubuntu CVE Tracker | Ubuntu packages | Daily |
|
||||
| Red Hat OVAL | RHEL/CentOS packages | Daily |
|
||||
| GitHub Advisory Database | Language packages | Continuous |
|
||||
| Go Vulnerability Database | Go modules | Continuous |
|
||||
| RustSec Advisory Database | Rust crates | Continuous |
|
||||
@@ -0,0 +1,58 @@
|
||||
# Aqua Security Container Scanning Workflows
|
||||
|
||||
## Workflow 1: CI/CD Image Gate
|
||||
|
||||
```
|
||||
Developer commits code
|
||||
|
|
||||
Docker image built in CI
|
||||
|
|
||||
Trivy scans image for vulnerabilities
|
||||
|
|
||||
[No Critical/High] --> Image pushed to registry
|
||||
[Critical found] --> Pipeline fails, image rejected
|
||||
|
|
||||
SBOM generated and stored alongside image
|
||||
|
|
||||
Image tagged with scan metadata
|
||||
|
|
||||
Kubernetes admission controller validates scan results
|
||||
|
|
||||
Deployment proceeds only with scanned images
|
||||
```
|
||||
|
||||
## Workflow 2: Registry Continuous Scanning
|
||||
|
||||
```
|
||||
New image pushed to container registry
|
||||
|
|
||||
Trivy Operator detects new image tag
|
||||
|
|
||||
Scheduled scan triggered
|
||||
|
|
||||
VulnerabilityReport CR created in cluster
|
||||
|
|
||||
New CVE published in NVD
|
||||
|
|
||||
Re-scan of all running images
|
||||
|
|
||||
Alert generated for newly affected images
|
||||
|
|
||||
Remediation ticket created automatically
|
||||
```
|
||||
|
||||
## Workflow 3: SBOM-Based Vulnerability Tracking
|
||||
|
||||
```
|
||||
Image scanned, SBOM generated (CycloneDX/SPDX)
|
||||
|
|
||||
SBOM stored in artifact repository
|
||||
|
|
||||
New CVE published
|
||||
|
|
||||
SBOM re-scanned without rebuilding image
|
||||
|
|
||||
Affected images identified across fleet
|
||||
|
|
||||
Prioritized patching based on exposure and severity
|
||||
```
|
||||
@@ -0,0 +1,159 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Trivy Container Scanning Report Aggregator
|
||||
|
||||
Processes Trivy JSON scan results and generates consolidated
|
||||
vulnerability reports across multiple container images.
|
||||
"""
|
||||
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import subprocess
|
||||
from datetime import datetime
|
||||
from collections import defaultdict
|
||||
|
||||
|
||||
def run_trivy_scan(image: str, output_file: str) -> dict:
|
||||
cmd = [
|
||||
"trivy", "image",
|
||||
"--format", "json",
|
||||
"--output", output_file,
|
||||
"--severity", "CRITICAL,HIGH,MEDIUM,LOW",
|
||||
image,
|
||||
]
|
||||
result = subprocess.run(cmd, capture_output=True, text=True)
|
||||
if result.returncode not in (0, 1):
|
||||
print(f"Trivy scan failed for {image}: {result.stderr}")
|
||||
return {}
|
||||
with open(output_file) as f:
|
||||
return json.load(f)
|
||||
|
||||
|
||||
def parse_trivy_results(scan_data: dict) -> dict:
|
||||
summary = {
|
||||
"vulnerabilities": [],
|
||||
"severity_counts": defaultdict(int),
|
||||
"fixable_count": 0,
|
||||
"packages_affected": set(),
|
||||
}
|
||||
for result in scan_data.get("Results", []):
|
||||
target = result.get("Target", "")
|
||||
target_type = result.get("Type", "")
|
||||
for vuln in result.get("Vulnerabilities", []):
|
||||
entry = {
|
||||
"id": vuln.get("VulnerabilityID"),
|
||||
"severity": vuln.get("Severity", "UNKNOWN"),
|
||||
"package": vuln.get("PkgName"),
|
||||
"installed_version": vuln.get("InstalledVersion"),
|
||||
"fixed_version": vuln.get("FixedVersion"),
|
||||
"title": vuln.get("Title", ""),
|
||||
"target": target,
|
||||
"target_type": target_type,
|
||||
}
|
||||
summary["vulnerabilities"].append(entry)
|
||||
summary["severity_counts"][entry["severity"]] += 1
|
||||
summary["packages_affected"].add(entry["package"])
|
||||
if entry["fixed_version"]:
|
||||
summary["fixable_count"] += 1
|
||||
|
||||
summary["packages_affected"] = list(summary["packages_affected"])
|
||||
summary["severity_counts"] = dict(summary["severity_counts"])
|
||||
return summary
|
||||
|
||||
|
||||
def generate_fleet_report(images: list) -> dict:
|
||||
report = {
|
||||
"generated_at": datetime.utcnow().isoformat() + "Z",
|
||||
"total_images": len(images),
|
||||
"total_vulnerabilities": 0,
|
||||
"total_critical": 0,
|
||||
"total_fixable": 0,
|
||||
"severity_summary": defaultdict(int),
|
||||
"top_cves": defaultdict(int),
|
||||
"image_reports": [],
|
||||
}
|
||||
|
||||
for i, image in enumerate(images):
|
||||
print(f"Scanning {i+1}/{len(images)}: {image}")
|
||||
output_file = f"/tmp/trivy_scan_{i}.json"
|
||||
scan_data = run_trivy_scan(image, output_file)
|
||||
if not scan_data:
|
||||
continue
|
||||
|
||||
parsed = parse_trivy_results(scan_data)
|
||||
vuln_count = len(parsed["vulnerabilities"])
|
||||
report["total_vulnerabilities"] += vuln_count
|
||||
report["total_critical"] += parsed["severity_counts"].get("CRITICAL", 0)
|
||||
report["total_fixable"] += parsed["fixable_count"]
|
||||
|
||||
for sev, count in parsed["severity_counts"].items():
|
||||
report["severity_summary"][sev] += count
|
||||
|
||||
for vuln in parsed["vulnerabilities"]:
|
||||
report["top_cves"][vuln["id"]] += 1
|
||||
|
||||
report["image_reports"].append({
|
||||
"image": image,
|
||||
"total_vulnerabilities": vuln_count,
|
||||
"severity_counts": parsed["severity_counts"],
|
||||
"fixable": parsed["fixable_count"],
|
||||
"critical_vulns": [
|
||||
v for v in parsed["vulnerabilities"] if v["severity"] == "CRITICAL"
|
||||
],
|
||||
})
|
||||
|
||||
report["severity_summary"] = dict(report["severity_summary"])
|
||||
top_sorted = sorted(report["top_cves"].items(), key=lambda x: x[1], reverse=True)[:20]
|
||||
report["top_cves"] = dict(top_sorted)
|
||||
return report
|
||||
|
||||
|
||||
def print_fleet_report(report: dict) -> None:
|
||||
print(f"\n{'='*60}")
|
||||
print(f"Container Fleet Vulnerability Report")
|
||||
print(f"Generated: {report['generated_at']}")
|
||||
print(f"{'='*60}")
|
||||
print(f"Images scanned: {report['total_images']}")
|
||||
print(f"Total vulnerabilities: {report['total_vulnerabilities']}")
|
||||
print(f"Total critical: {report['total_critical']}")
|
||||
print(f"Total fixable: {report['total_fixable']}")
|
||||
print(f"\nSeverity Breakdown:")
|
||||
for sev in ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"]:
|
||||
count = report["severity_summary"].get(sev, 0)
|
||||
if count:
|
||||
print(f" {sev:12s}: {count}")
|
||||
print(f"\nImages by Risk (sorted by critical count):")
|
||||
for img in sorted(
|
||||
report["image_reports"],
|
||||
key=lambda x: x["severity_counts"].get("CRITICAL", 0),
|
||||
reverse=True,
|
||||
):
|
||||
crits = img["severity_counts"].get("CRITICAL", 0)
|
||||
print(f" {img['image']:50s} | Critical: {crits} | Total: {img['total_vulnerabilities']}")
|
||||
|
||||
|
||||
def main():
|
||||
images_env = os.environ.get("SCAN_IMAGES", "")
|
||||
if images_env:
|
||||
images = [i.strip() for i in images_env.split(",") if i.strip()]
|
||||
else:
|
||||
images = [
|
||||
"python:3.11-slim",
|
||||
"node:20-alpine",
|
||||
"nginx:latest",
|
||||
"golang:1.22-alpine",
|
||||
]
|
||||
print("No SCAN_IMAGES env var set, using default image list")
|
||||
|
||||
report = generate_fleet_report(images)
|
||||
print_fleet_report(report)
|
||||
|
||||
output = f"container_scan_report_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}.json"
|
||||
with open(output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
print(f"\nReport saved to: {output}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user