Project: KICS (Provisioning / Security & Compliance)
File: integrations_terraformer.md

From version 1.5, KICS integrates with Terraformer to scan resources deployed in the Cloud. The runtime information of the resources is obtained by providing a Terraformer path to KICS, via `-p` flag. The scan happens immediately after this information is obtained. In the end, results are shown as for any other KICS scan. Cloud providers supported: AWS AZURE GCP For KICS to get the runtime information of your resources you need to provide AWS account Credentials as environment variables. Please note the AWS account provided should have read permissions to list service resources. Setting AWS credentials as environment variables MacOS and Linux: ```sh export AWSACCESSKEYID="<AWSACCESSKEYID>" export AWSSECRETACCESSKEY="<AWSSECRETACCESSKEY>" export AWSSESSIONTOKEN="<AWSSESSIONTOKEN>" ``` Windows: ```sh SET AWSACCESSKEYID=<AWSACCESSKEYID> SET AWSSECRETACCESSKEY=<AWSSECRETACCESSKEY> SET AWSSESSIONTOKEN=<AWSSESSIONTOKEN> ``` Powershell: ```sh $Env:AWSACCESSKEYID="<AWSACCESSKEYID>" $Env:AWSSECRETACCESSKEY="<AWSSECRETACCESSKEY>" $Env:AWSSESSIONTOKEN="<AWSSESSIONTOKEN>" ``` KICS provides two possibilities to use Terraformer with AZURE. Each one requires AZURE account credentials that you need to set as environment variables. MacOS and Linux: ```sh export ARMSUBSCRIPTIONID="<ARMSUBSCRIPTIONID>" export ARMCLIENTID="<ARMCLIENTID>" export ARMCLIENTCERTIFICATEPATH="<ARMCLIENTCERTIFICATEPATH>" export ARMCLIENTCERTIFICATEPASSWORD="<ARMCLIENTCERTIFICATEPASSWORD>" export ARMTENANTID="<ARMTENANTID>" ``` Windows: ```sh SET ARMSUBSCRIPTIONID=<ARMSUBSCRIPTIONID> SET ARMCLIENTID="<ARMCLIENTID>" SET ARMCLIENTCERTIFICATEPATH="<ARMCLIENTCERTIFICATEPATH>" SET ARMCLIENTCERTIFICATEPASSWORD="<ARMCLIENTCERTIFICATEPASSWORD>" SET ARMTENANTID="<ARMTENANTID>" ``` Powershell: ```sh $Env:ARMSUBSCRIPTIONID="<ARMSUBSCRIPTIONID>" $Env:ARMCLIENTID="<ARMCLIENTID>" $Env:ARMCLIENTCERTIFICATEPATH="<ARMCLIENTCERTIFICATEPATH>" $Env:ARMCLIENTCERTIFICATEPASSWORD="<ARMCLIENTCERTIFICATEPASSWORD>" $Env:ARMTENANTID="<ARMTENANTID>" ``` MacOS and Linux: ```sh export ARMSUBSCRIPTIONID="<ARMSUBSCRIPTIONID>" export ARMCLIENTID="<ARMCLIENTID>" export ARMCLIENTSECRET="<ARMCLIENTSECRET>" export ARMTENANTID="<ARMTENANTID>" ``` Windows: ```sh SET ARMSUBSCRIPTIONID=<ARMSUBSCRIPTIONID> SET ARMCLIENTID="<ARMCLIENTID>" SET ARMCLIENTSECRET="<ARMCLIENTSECRET>" SET ARMTENANTID="<ARMTENANTID>" ``` Powershell: ```sh $Env:ARMSUBSCRIPTIONID="<ARMSUBSCRIPTIONID>" $Env:ARMCLIENTID="<ARMCLIENTID>" $Env:ARMCLIENTSECRET="<ARMCLIENTSECRET>" $Env:ARMTENANTID="<ARMTENANTID>" ``` ```sh terraformer::{CloudProvider}:{Resources}:{Regions} ``` ```sh terraformer::{CloudProvider}:{Resources} ``` ```sh terraformer::{CloudProvider}:{Resources}:{Regions}:{Projects} ``` CloudProvider: The name of the Cloud Provider to import from. Possible values: `aws` `azure` `gcp` Resources: A slash-separated list of the resources intended to be imported and scanned. You can find a complete list of possible values in the links below: To import all resources please use: `*` Regions: A slash-separated list of the regions to import from. It is only required for AWS and GCP. Projects: A slash-separated list of the projects ids to import from. It is only required for GCP. When Running KICS using a terraformer path, resources are imported using the credentials set as environment variables in terraform format to the current working directory in a new folder named `kics-extract-terraformer` following the above-described structure. KICS will then run a scan on these local files. If the flag `-o, --output-path` is passed the folder `kics-extract-terraformer` will be generated in the reports directory instead. ``` kics-extract-terraformer/ {region}/ {resource}/ provider.tf {resource}.tf terraform.tfstate

``` To run KICS Terraformer integration with Docker simply pass the AWS Credentials that were set as environment variables to the `docker run` command and use the terraformer path syntax Examples: ```sh docker run -e AWSSECRETACCESSKEY -e AWSACCESSKEYID -e AWSSESSIONTOKEN checkmarx/kics:latest scan -p "terraformer::aws:vpc:eu-west-2" -v --no-progress ``` ```sh docker run -e AWSSECRETACCESSKEY -e AWSACCESSKEYID -e AWSSESSIONTOKEN -v ${PWD}:/path/ checkmarx/kics:latest scan -p "terraformer::aws:vpc:eu-west-2" -v --no-progress -o /path/results ``` <img src="./img/docker_terraformer.gif" /> To run KICS Terraformer integration with Docker simply pass the AZURE Credentials that were set as environment variables to the docker run command and use the terraformer path syntax. Choose one of the following options: Note that you should fill the `<certificatepath>` with the path that points to the directory where your certificate is located, and the `<certificate-name>` should point to the certificate name located in `<certificatepath>`. ```sh docker run -v <certificatepath>:/certificate -e ARMCLIENTCERTIFICATEPATH=/certificate/<certificatename>.pfx -e ARMCLIENTCERTIFICATEPASSWORD -e ARMTENANTID -e ARMCLIENTID -e ARMSUBSCRIPTIONID checkmarx/kics:latest scan -p "terraformer::azure:storage_account" -v --no-progress ``` ```sh docker run -v <certificatepath>:/certificate -v ${PWD}:/path/ -e ARMCLIENTCERTIFICATEPATH=/certificate/<certificatename>.pfx -e ARMCLIENTCERTIFICATEPASSWORD -e ARMTENANTID -e ARMCLIENTID -e ARMSUBSCRIPTIONID checkmarx/kics:latest scan -p "terraformer::azure:storage_account" -v --no-progress -o /path/results ``` ```sh docker run -e ARMSUBSCRIPTIONID -e ARMCLIENTID -e ARMCLIENTSECRET -e ARMTENANTID checkmarx/kics:latest scan -p "terraformer::azure:storage_account" -v --no-progress ``` ```sh docker run -e ARMSUBSCRIPTIONID -e ARMCLIENTID -e ARMCLIENTSECRET -e ARMTENANTID -v ${PWD}:/path/ checkmarx/kics:latest scan -p "terraformer::azure:storage_account" -v --no-progress -o /path/results ``` To run KICS Terraformer integration with Docker, pass the path that points to the JSON file that contains your service account key as an environment variable (GOOGLEAPPLICATIONCREDENTIALS) to the docker run command and use the terraformer path syntax. Note that your project should have a region defined, and your account should have read permissions to list resources. Also note that you should fill the `<credentialspath>` with the path that points to the directory where your service account key file is located, and the `<credentials-file-name>` should point to the service account key file name located in `<credentialspath>`. ```sh docker run -v <credentialspath>:/credentials -e GOOGLEAPPLICATION_CREDENTIALS=/credentials/<credentials-file-name> checkmarx/kics:latest scan -p "terraformer::gcp:gcs:us-east4:project" -v --no-progress --log-level=DEBUG ``` ```sh docker run -v <credentialspath>:/credentials -v ${PWD}:/path/ -e GOOGLEAPPLICATION_CREDENTIALS=/credentials/<credentials-file-name> checkmarx/kics:latest scan -p "terraformer::gcp:gcs:us-east4:project" -v --no-progress --log-level=DEBUG -o /path/results ``` If environment credentials are incorrect a timeout may occur. If the resource to import doesn't exist in the region specified a {resource}.tf file will not be created. You can find the Terraform output in `terraformer-output.txt` inside `kics-extract-terraformer` folder.