Support trivy

[suzuki-shunsuke]

Feature Overview

Support trivy in the test action.

Why is the feature needed?

• tfsec is joining the Trivy family aquasecurity/tfsec#1994

aquasecurity is going to merge the feature of tfsec into trivy.
So tfaction should support trivy.

Note that we are not familiar with trivy at all, so first we have to take a look at trivy.

Does the feature include Breaking Changes?

No. We should keep the compatibility.

Users should select either trivy or tfsec and by default trivy should be used for the compatibility.
But tfsec will not be developed actively, so we have to consider using trivy instead of tfsec by default.

Example Code

GitHub Actions

tfaction-root.yaml

tfaction.yaml

Reference

• https://github.com/aquasecurity/trivy
• tfsec is joining the Trivy family aquasecurity/tfsec#1994

[suzuki-shunsuke]

https://aquasecurity.github.io/trivy/v0.40/docs/misconfiguration/scanning/
https://aquasecurity.github.io/trivy/v0.40/docs/references/cli/trivy_config/
https://aquasecurity.github.io/trivy/v0.41/docs/configuration/

[suzuki-shunsuke]

Hmm. I can't understand how to use trivy.

I tried to run trivy config command in my Terraform repository, but the command failed.

$ trivy config github
2023-05-20T11:02:26.695+0900	INFO	Misconfiguration scanning is enabled
2023-05-20T11:02:26.695+0900	INFO	Need to update the built-in policies
2023-05-20T11:02:26.695+0900	INFO	Downloading the built-in policies...
2023-05-20T11:02:27.572+0900	ERROR	Falling back to embedded policies: failed to download built-in policies: download error: OCI repository error: 1 error occurred:
	* GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Fdefsec%3Apull&service=ghcr.io: DENIED: denied

Maybe GitHub Access token is needed?

And I couldn't find the document about trivy.yaml.

[suzuki-shunsuke]

Solved. aquasecurity/trivy#2689 (reply in thread)

$ docker logout ghcr.io
Removing login credentials for ghcr.io

$ trivy config github
2023-05-20T20:18:52.382+0900	INFO	Misconfiguration scanning is enabled
2023-05-20T20:18:52.383+0900	INFO	Need to update the built-in policies
2023-05-20T20:18:52.383+0900	INFO	Downloading the built-in policies...
39.88 KiB / 39.88 KiB [--------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2023-05-20T20:18:54.147+0900	INFO	Detected config files: 0

[suzuki-shunsuke]

TODO:

• Output Format

[suzuki-shunsuke]

tfsec doesn't support Terraform's import block.
The maintainers encourages users to migrate to trivy, and they don't plan to update tfsec to support Terraform's import block.
https://github.com/aquasecurity/tfsec/issues/2070#issuecomment-1673920879

We need to handle this issue.

[suzuki-shunsuke]

The official migration guide.
https://github.com/aquasecurity/tfsec/blob/master/tfsec-to-trivy-migration-guide.md

[suzuki-shunsuke]

#1106

[suzuki-shunsuke]

Done.