Snyk IaCの結果をWeb UIに直接出力する

たかくに

2022.07.15

この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。

こんにちは！AWS事業本部コンサルティング部のたかくに（@takakuni_）です。

今回は、Snyk IaCの解析結果をWeb UI直接出力してみようと思います。

はじめに

Snyk IaCでは GitHub などのSCM (Source Control Management)と統合可能です。Web UIでは、SCMの変更検知をトリガーに解析を開始します。

では、SCMがセキュリティポリシーで使えない等の制約があり、Web UIで確認したい場合どうすればいいのでしょうか。

答えは、今回ご紹介する「--report」オプションで閲覧可能になります。

やってみた

以下ブログで使用したコードを再利用します。

data "aws_availability_zones" "azs" {
  all_availability_zones = false
  state = "available"
}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = data.aws_availability_zones.azs.names
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = false
  enable_vpn_gateway = false

  tags = {}
}

resource "aws_s3_bucket" "bucket" {
  bucket = "snyk-test-bucket"
}

また、今回はデプロイする全てのリソースに対して解析を行いたいため、「--scan=planned-values」オプションを追加してコマンドを実行します。

jsonへの整形

解析範囲をデプロイするリソースのコードに限定したいため、terraform plan/showコマンドを使用して解析用ファイルを作成します。


terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tf-plan.json

解析結果の出力

「--report」オプションを使用して、解析結果をSynk Web UIに送信します。

78行目のURLを使用して実際に確認してみます。

snyk iac test tf-plan.json --report

Snyk Infrastructure as Code

✔ Test completed.

Issues

Low Severity Issues: 6

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["2"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["0"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["1"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] S3 bucket versioning disabled
  Info:    S3 bucket versioning is disabled. Changes or deletion of objects will not be reversible
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-124
  Path:    resource > aws_s3_bucket[bucket] > versioning > enabled
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, set `versioning.enabled` attribute to `true`. For AWS provider >= v4.0.0, add aws_s3_bucket_versioning resource.

  [Low] S3 bucket MFA delete control disabled
  Info:    S3 bucket will not enforce MFA login on delete requests. Object could be deleted without stronger MFA authorization
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-127
  Path:    resource > aws_s3_bucket[bucket] > versioning > mfa_delete
  File:    tf-plan.json
  Resolve: Follow instructions in `https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html` to manually configure the MFA setting. For AWS provider < v4.0.0 set `versioning.mfa_delete` attribute to `true` in aws_s3_bucket resource. For AWS provider >= v4.0.0 set 'versioning_configuration.mfa_delete` attribute to `Enabled`. The terraform change is required to reflect the setting in the state file

  [Low] S3 server access logging is disabled
  Info:    The s3 access logs will not be collected. There will be no audit trail of access to s3 objects
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-45
  Path:    input > resource > aws_s3_bucket[bucket] > logging
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, add `logging` block attribute. For AWS provider >= v4.0.0, add aws_s3_bucket_logging resource.

Medium Severity Issues: 1

  [Medium] Non-encrypted S3 Bucket
  Info:    Non-encrypted S3 Bucket. A non-encrypted S3 bucket increases the likelihood of unintentional data exposure
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-4
  Path:    input > resource > aws_s3_bucket[bucket]
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, set `server_side_encryption_configuration` block attribute. For AWS provider >= v4.0.0 add aws_s3_bucket_server_side_encryption_configuration resource.

-------------------------------------------------------

Test Summary

  Organization: takakuni
  Project name: snyk_iac_test

✔ Files without issues: 0
✗ Files with issues: 1
  Ignored issues: 0
  Total issues: 7 [ 0 critical, 0 high, 1 medium, 6 low ]

-------------------------------------------------------

Report Complete

  Your test results are available at: https://snyk.io/org/takakuni/projects
  under the name: snyk_iac_test

Snyk Web UIで結果が送信されていることがわかります。

プロジェクトに属性を追加する

Snyk CLIでは、「--report」オプション使用時に限り指定可能なオプションが別途用意されています。オプションでは、プロジェクトに属性を追加する役割を担っています。

具体的には以下のオプションになります。

--project-tags
--project-business-criticality
--project-environment
--project-lifecycle

実際にコマンドを指定し、Snyk Web UIから結果を確認してみます。

snyk iac test tf-plan.json --report \
--project-tags=team=takakuni \
--project-business-criticality=low \
--project-environment=backend \
--project-lifecycle=sandbox