Project: KICS (Provisioning / Security & Compliance)
File: platforms.md

KICS support scanning multiple technologies, in the next sections you will find more details about each technology. KICS supports scanning Ansible files with `.yaml` extension. KICS can decrypt Ansible Vault files on the fly. For that, you need to define the environment variable `ANSIBLEVAULTPASSWORD_FILE`. KICS supports scanning Ansible Configuration files with `.cfg` or `.conf` extension. KICS supports scanning Ansible Inventory files with `.ini`, `.json` or `.yaml` extension. KICS supports scanning Azure Resource Manager (ARM) templates with `.json` extension. KICS supports scanning Bicep files with `.bicep` extension. For instructions on converting between ARM JSON templates and Bicep code, refer to the . To understand the distinctions between the two, explore the . Note that KICS recognizes this technology as Azure Resource Manager (for queries purpose). Explore our ongoing enhancements and planned features on our page. is a software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. It has all the advantages of using . KICS currently support scanning AWS Cloudformation templates. In this guide, we will describe how to scan a simple CDK defined infrastructure following the documentation. Make sure all are met. Create a new CDK project using the CLI. e.g: ```bash mkdir test-cdk cd test-cdk cdk init app --language go ``` Download dependencies ```bash go mod download ``` Synthetize CloudFormation template ```bash cdk synth > cfn-stack.yaml ``` Execute KICS against the template and check the results. Note that KICS will recognized it as CloudFormation (for queries purpose). ```bash docker run -t -v $PWD/cfn-stack.yaml:/path/cfn-stack.yaml -it checkmarx/kics:latest scan -p /path/cfn-stack.yaml ``` KICS supports scanning Github Workflows CICD files with `.yaml` or `.yml` extension. KICS supports scanning CloudFormation templates with `.json` or `.yaml` extension. KICS supports scanning Crossplane manifests with `.yaml` extension. KICS supports scanning Azure Blueprints files, including Azure Blueprints Policy Assignment Artifacts, Azure Blueprints Role Assignment Artifacts, and Azure Blueprints Template Artifacts with `.json` extension. Note that KICS recognizes this technology as Azure Resource Manager (for queries purpose). KICS supports scanning Docker files with any name (but with no extension) and files with `.dockerfile` extension. KICS supports scanning DockerCompose files with `.yaml` extension. KICS supports scanning gRPC files with `.proto` extension. KICS supports scanning Helm by rendering charts and running Kubernetes queries against the rendered manifest. The charts file structure must be as explained by Helm: https://helm.sh/docs/topics/charts/#the-chart-file-structure. Results are displayed against original Helm files: ``` Service With External Load Balance, Severity: MEDIUM, Results: 1 Description: Service has an external load balancer, which may cause accessibility from other networks and the Internet Platform: Kubernetes 019: release: {{ template "nginx-ingress.releaseLabel" . }} 020: name: {{ template "nginx-ingress.controller.fullname" . }} 021: spec: ``` KICS supports scanning Knative manifests with `.yaml` extension. Due to the possibility of the definition of the in Knative files, Kubernetes Security Queries are also loaded once the presence of the Knative files is detected. KICS supports scanning Kubernetes manifests with `.yaml` extension. KICS supports scanning Swagger 2.0 and OpenAPI 3.0 specs with `.json` and `.yaml` extension. KICS supports scanning Pulumi manifests with `.yaml` extension. KICS supports scanning Serverless manifests with `.yml` extension. Due to the possibility of the definition of the CloudFormation template, inside

CloudFormation Security Queries are also loaded once the presence of the ServerlessFW files is detected. KICS supports scanning Google Deployment Manager files with `.yaml` extension. KICS supports AWS Serverless Application Model (AWS SAM) files with `.yaml` extension. Note that KICS recognizes this technology as CloudFormation (for queries purpose). KICS supports scanning Terraform's HCL files with `.tf` extension and input variables using `terraform.tfvars` or files with `.auto.tfvars` extension that are in same directory of `.tf` files. KICS supports scanning terraform plans given in JSON. The `planned_values` will be extracted, built in a way that KICS can understand, and scanned as a normal terraform file. Results will point to the plan file. To get terraform plan in JSON format simply run the command: ``` terraform show -json plan-sample.tfplan > plan-sample.tfplan.json ``` KICS supports some official modules for AWS that can be found on , you can see the supported modules list in the libraries folder . This means KICS can find issues in verified modules listed on this json. Currently, KICS does not support unofficial or custom modules. KICS supports scanning CDKTF output JSON. It recognizes it through the fields `metadata`, `stackName`, and `terraform`. To get your CDKTF output JSON, run the following command inside the directory that contains your app: ``` cdktf synth ``` You can also run the command `cdktf synth --json` to display it in the terminal. When using vars in a terraform file there are 2 ways of passing the file in which a variable's value is present. If none of these options are used kics will only resolve variables coming from the `*.auto.tfvars` files and the default variable values. By adding, as the first line in a TF file, a rule that follows the logic below: ``` // kicsterraformvars: path/to/terraform/vars.tf ``` This line is a comment that Kics will look for when trying to decypher the variables used in that file. By adding the flag `--terraform-vars-path` to the scan command it is possible to input the path of the variables fiel that will be used for all the files in the project. _NOTE:_ when using both options the flag option will take precedence and therefore define the variables. At the moment, KICS does not support a robust approach to identifying Ansible samples. The identification of these samples is done through exclusion. When a YAML sample is not a CloudFormation, Google Deployment Manager, Helm, Kubernetes or OpenAPI sample, KICS recognize it as Ansible. Thus, KICS recognize other YAML samples (that are not Ansible) as Ansible, e.g. GitHub Actions samples. However, you can ignore these samples by writing `#kics-scan ignore` on the top of the file. For more details, please read this . Although KICS support variables and interpolations, KICS does not support functions and enviroment variables. In case of variables used as function parameters, it will parse as wrapped expression, so the following function call: ```hcl resource "awslaunchconfiguration" "example" { imageid = data.awsami.ubuntu.id instancetype = "${concat(list("${var.name}", "${var.othername}"), var.node_tags)}" spot_price = var.price userdatabase64 = "${var.data}==" } ``` Considering `var.data = "a123B"` and `var.price = 1.023`, it would be parsed like the following example: ```hcl resource "awslaunchconfiguration" "example" { imageid = data.awsami.ubuntu.id instancetype = "${concat(list("${var.name}", "${var.othername}"), var.node_tags)}" spot_price = 1.023 userdatabase64 = "a123B==" } ```