Project: KICS (Provisioning / Security & Compliance)
File: integrations_codefresh.md

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS Codefresh step by Checkmarx. You can find the KICS Codefresh step . Please, be aware that the KICS Codefresh step can require MEDIUM instances. | Variable | Example Value &nbsp; | Description &nbsp; | Type | Required | Default | | - | | -- | - | -- | | | PROJECT_PATH | terraform/main.tf,Dockerfile | paths to a file or directories to scan, comma separated list | string | Yes | N/A | | IGNORE\ON\EXIT | results | defines which kind of non-zero exits code should be ignored (all, results, errors, none) | string | No | N/A | | FAIL_ON | high,medium | which kind of results should return an exit code different from 0 | string | No | critical,high,medium,low,info | | TIME_OUT | 75 | number of seconds the query has to execute before being canceled | string | No | 60 | | PROFILING | CPU | enables performance profiler that prints resource consumption metrics in the logs during the execution (CPU, MEM) | string | No | N/A | | TYPES | Ansible,Terraform | case insensitive list of platform types to scan (Ansible, AzureResourceManager, CloudFormation, Dockerfile, Docker Compose, GRPC, GoogleDeploymentManager, Kubernetes, OpenAPI, Terraform) | string | No | All | | EXCLUDE_PATHS |

| exclude paths from scan | string | No | N/A | | EXCLUDE_QUERIES | e69890e6-fce5-461d-98ad-cb98318dfc96,4728cd65-a20c-49da-8b31-9c08b423e4db | exclude queries by providing the query ID; cannot be provided with query inclusion flags | string | No | N/A | | EXCLUDE_CATEGORIES | Access control,Best practices | exclude categories by providing its name; cannot be provided with query inclusion flags | string | No | N/A | | EXCLUDE_SEVERETIES | info,low | exclude results by providing the severity of a result | string | No | N/A | | EXCLUDE_RESULTS | d4a1fa80-d9d8-450f-87c2-e1f6669c41f8 | exclude results by providing the similarity ID of a result | string | No | N/A | | INCLUDE_QUERIES | a227ec01-f97a-4084-91a4-47b350c1db54 | include queries by providing the query ID; cannot be provided with query exclusion flags | string | No | N/A | | OUTPUT_FORMATS | json,sarif | formats in which the results will be exported (all, asff, csv, cyclonedx, glsast, html, json, junit, pdf, sarif, sonarqube) | string | No | json | | OUTPUT_PATH | myResults/ | directory path to store reports | string | No | N/A | | PAYLOAD_PATH | /tmp/mypayload.json | path to store internal representation JSON file | string | No | N/A | | QUERIES_PATH | query | "example": "/tmp/mypayload.json" | string | No | ./assets/queries downloaded with the binaries | | VERBOSE | true | write logs to stdout too (mutually exclusive with silent) | boolean | No | false | | BOM | true | include bill of materials (BoM) in results output; | boolean | No | false | | DISABLE\FULL\DESCRIPTIONS | true | disable request for full descriptions and use default vulnerability descriptions | boolean | No | false | | DISABLE_SECRETS | true | disable secrets scanning | boolean | No | false | | SECRETS\REGEXES\PATH | ./mydir/secrets-config.json | path to secrets regex rules configuration file | string | No | N/A | | LIBRARIES_PATH | ./myLibsDir | path to directory with libraries | string | No | N/A | ``` steps: clone: title: Clone a project type: git-clone repo: 'rafaela-soares/query' git: github run_kics: title: Scanning IaC files type: checkmarx/kics arguments: PROJECT_PATH: ./query ``` Be aware that you should set `IGNOREONEXIT: results` to be able to avoid the KICS exit code and run the step that saves the report. ``` steps: clone: title: Clone a project type: git-clone repo: 'rafaela-soares/query' git: github run_kics: title: Scanning IaC files type: checkmarx/kics arguments: PROJECT_PATH: ./query QUERIESPATH: ./query/alblisteningonhttp OUTPUT_PATH: /codefresh/volume/query/reports OUTPUT_FORMATS: all VERBOSE: true EXCLUDEPATHS: ./query/alblisteningonhttp/test/negative.yaml TYPES: Ansible LOG_LEVEL: DEBUG PAYLOAD_PATH: /codefresh/volume/query/payload.json IGNOREONEXIT: results savereportsand_payload: title: Saving KICS payload and KICS reports type: git-commit arguments: repo: 'rafaela-soares/query' git: github working_directory: '/codefresh/volume/query' commit_message: saved payload and reports gitusername: git-user-name gituseremail: git-user@email.com allow_empty: false add: payload.json ./reports ``` ``` steps: clone: title: Clone a project type: git-clone repo: 'rafaela-soares/query' git: github run_kics: title: Scanning IaC files type: checkmarx/kics arguments: PROJECT_PATH: ./query QUERIESPATH: ./query/alblisteningonhttp OUTPUT_PATH: /codefresh/volume/query/reports OUTPUT_FORMATS: all VERBOSE: true EXCLUDEPATHS: ./query/alblisteningonhttp/test/negative.yaml TYPES: Ansible LOG_LEVEL: DEBUG IGNOREONEXIT: results savereportsins3bucket: title: Saving KICS reports image: 'amazon/aws-cli' working_directory: '/codefresh/volume/query' commands: mkdir ~/.aws touch ~/.aws/config chmod 600 ~/.aws/config echo "[default]" > ~/.aws/config echo "awsaccesskeyid=${AWSACCESSKEYID}" >> ~/.aws/config echo "awssecretaccesskey=${AWSSECRETACCESSKEY}" >> ~/.aws/config echo "awssessiontoken=${AWSSESSIONTOKEN}" >> ~/.aws/config echo "region=${AWS_REGION}" >> ~/.aws/config aws s3 cp ./reports s3://${{BUCKET_NAME}}/ --recursive ```