WEBVTT 00:00:01.940 --> 00:00:06.090 So let's start here in the Terrascan documentation. 00:00:06.230 --> 00:00:11.400 I'm actually at runterrascan.io, if you'll see up here in the address bar, 00:00:11.620 --> 00:00:14.810 and this is the homepage for the Terrascan tool. 00:00:14.960 --> 00:00:16.750 And we have a couple of different options here. 00:00:16.750 --> 00:00:19.660 If I go over to the GitHub page, for example, 00:00:19.840 --> 00:00:21.910 this is the source code for Terrascan, 00:00:21.910 --> 00:00:26.660 and you can get a few things here like instructions on how to install or 00:00:26.660 --> 00:00:30.370 scan with it or even integrate it into other processes. 00:00:30.580 --> 00:00:32.980 I'm going to go ahead and leave this alone for now. 00:00:32.980 --> 00:00:34.140 I'll go back one. 00:00:34.520 --> 00:00:37.820 I'll go back to the homepage and go over to Documentation. 00:00:38.200 --> 00:00:42.770 And this has got a lot of the same information, plus a little bit extra. 00:00:42.780 --> 00:00:46.130 The thing I want to direct you to first though is the 00:00:46.130 --> 00:00:48.880 Policies page here on the left‑hand side, 00:00:49.190 --> 00:00:51.110 so let's navigate over there. 00:00:51.940 --> 00:00:55.360 And then, depending on what kind of resources you're scanning, 00:00:55.840 --> 00:00:58.350 there's different policies for each provider. 00:00:58.400 --> 00:01:03.290 The code I'm going to be scanning is some AWS resources, 00:01:03.290 --> 00:01:06.280 so I'm going to go ahead and navigate to AWS Policies. 00:01:06.280 --> 00:01:09.810 And you see there's a bunch of different policies here for 00:01:09.810 --> 00:01:12.440 each type of resource you want to create. 00:01:12.440 --> 00:01:14.990 The one I've got in the demo that I'm going to show you 00:01:14.990 --> 00:01:18.320 in just a minute is an AWS S3 bucket. 00:01:18.480 --> 00:01:21.740 So if I search for that, I'll see it right here on the side, 00:01:22.020 --> 00:01:26.570 and there's a couple of different policies for an AWS S3 bucket. 00:01:26.920 --> 00:01:29.750 Take a note of the different reference IDs on the right‑hand side 00:01:29.750 --> 00:01:32.360 because this is going to come in handy later on as well. 00:01:32.640 --> 00:01:37.380 So with that being said, let's go ahead and switch over to Visual Studio Code. 00:01:37.540 --> 00:01:40.560 I'll pause the video here and then come back in just a moment. 00:01:42.340 --> 00:01:43.320 So welcome back. 00:01:43.320 --> 00:01:48.440 I'm here in Visual Studio Code in the Terrascan demo repository. 00:01:48.450 --> 00:01:51.730 And I'll have a link to this at the end of the slides, 00:01:52.140 --> 00:01:53.950 so if you want to follow along during, 00:01:53.960 --> 00:01:57.860 I'd say go ahead and skip to the last slide of this module 00:01:57.870 --> 00:01:59.950 and you get a link to this repository, 00:01:59.950 --> 00:02:02.090 as well as all the instructions I'm using here. 00:02:02.140 --> 00:02:04.300 But I've got a couple of things going on here. 00:02:04.430 --> 00:02:12.730 First, I've got some data sources for the aws_caller_identity and in aws_kms key. 00:02:12.730 --> 00:02:15.040 The caller_identity's a personal preference, 00:02:15.040 --> 00:02:17.680 I like to put that in my bucket resources so that I 00:02:17.680 --> 00:02:19.570 can guarantee unique bucket names, 00:02:19.690 --> 00:02:23.630 but the KMS key is something that we need to encrypt the bucket, 00:02:23.630 --> 00:02:27.960 which I've done in the bucket resource on the block starting on line 14. 00:02:28.340 --> 00:02:33.050 Right now, I'm using a private ACL, I've got server‑side encryption enabled, 00:02:34.040 --> 00:02:37.480 and then at the bottom here, I've got a public access block. 00:02:37.630 --> 00:02:40.690 So, so far this seems like it's in pretty good shape. 00:02:40.700 --> 00:02:43.160 Let's go ahead and open up a terminal here. 00:02:44.040 --> 00:02:44.280 Now, 00:02:44.280 --> 00:02:48.500 the first thing I want to do is install Terrascan so that I can start using it. 00:02:48.620 --> 00:02:51.650 And I'm going to go ahead and do this on the command line, 00:02:51.660 --> 00:02:54.590 just install the binary for it, but if you prefer, 00:02:54.590 --> 00:02:57.140 there's other methods of installing this as well that 00:02:57.140 --> 00:02:58.900 are explained in the repository. 00:02:58.910 --> 00:03:01.760 So let's go over here, I've got to README file here, 00:03:01.940 --> 00:03:04.740 there's two different commands to install Terrascan, 00:03:04.740 --> 00:03:07.630 one for macOS and the other for Linux. 00:03:07.870 --> 00:03:12.350 So I'm running this on Linux, I'll go ahead and copy that and then run this. 00:03:14.390 --> 00:03:16.260 That's done, it's installed now. 00:03:16.470 --> 00:03:20.730 And you'll see the first thing it did is it ran a Terrascan with no flags. 00:03:20.730 --> 00:03:23.300 There's a couple of different commands here for us to use. 00:03:23.390 --> 00:03:25.790 Some of these I'll cover a little bit later on, 00:03:26.020 --> 00:03:28.560 but the first thing I want to do is run a terrascan init. 00:03:30.030 --> 00:03:32.070 That doesn't have to be done all the time, 00:03:32.070 --> 00:03:34.920 what it's going to do is it's going to just copy the latest 00:03:34.920 --> 00:03:38.030 policies from the Terrascan GitHub repository. 00:03:38.270 --> 00:03:40.110 And when working with a code scanning tool, 00:03:40.110 --> 00:03:44.090 you want to make sure that you have the latest and greatest policy definitions, 00:03:44.100 --> 00:03:47.370 just so if there's an update that addresses some sort of 00:03:47.370 --> 00:03:50.890 vulnerability that's been discovered, you make sure you have that in place. 00:03:51.040 --> 00:03:53.860 So now that I've got that set up, let me clear my screen, 00:03:54.740 --> 00:03:58.260 and I'll go ahead and I'll run a terrascan scan command. 00:03:59.610 --> 00:04:01.900 So you see it flagged me on a couple of things, 00:04:02.050 --> 00:04:03.950 Terrascan found two issues here, 00:04:03.960 --> 00:04:08.450 one for S3 access logging and the other for S3 versioning, 00:04:08.630 --> 00:04:11.230 and both of those are in the root module at the 00:04:11.230 --> 00:04:15.300 resource that starts on line 7 in main.tf. 00:04:15.300 --> 00:04:17.279 So let's go back to main.tf, 00:04:17.279 --> 00:04:24.080 and I'll go ahead and see this is my AWS S3 resource that starts on line 7. 00:04:24.090 --> 00:04:27.560 So one of these I'm interested in fixing and the other one I'm not. 00:04:27.570 --> 00:04:30.860 Obviously, the bucket versioning is something I want to turn on, 00:04:30.870 --> 00:04:31.880 that's quick and easy. 00:04:31.930 --> 00:04:34.610 I will go ahead and add a new block here. 00:04:34.650 --> 00:04:37.560 All right, so now versioning is enabled on this bucket, 00:04:37.640 --> 00:04:40.720 and let's go ahead and we'll run that scan one more time. 00:04:41.440 --> 00:04:45.370 You see now I've just got the access logging violation left, 00:04:45.510 --> 00:04:49.230 the S3 versioning violation is no longer present. 00:04:49.290 --> 00:04:50.150 This one, in particular, 00:04:50.150 --> 00:04:52.740 I'm not interested in fixing because I don't want to 00:04:52.740 --> 00:04:54.390 set up another bucket for logging. 00:04:54.390 --> 00:04:55.910 This is just for demo, 00:04:55.910 --> 00:04:59.650 I would not recommend you set it up this way in your production environment. 00:04:59.840 --> 00:05:01.480 This is just for demo purposes. 00:05:01.640 --> 00:05:04.420 I want to skip this check without actually adding the 00:05:04.420 --> 00:05:06.420 requisite Terraform block in place. 00:05:06.710 --> 00:05:10.040 So the first thing I'll need to skip this is back in the documentation, 00:05:10.050 --> 00:05:11.740 I'll need to get the rule ID. 00:05:11.960 --> 00:05:14.960 I'll pause the video here and go back to the docs page. 00:05:16.240 --> 00:05:21.350 All right, I'm back here in the policies documentation at runterrascan.io, 00:05:21.360 --> 00:05:24.050 and the rule I'm interested in skipping is this one right here, 00:05:24.050 --> 00:05:25.340 Logging and Monitoring. 00:05:25.410 --> 00:05:28.860 Ensure that S3 buckets have access logging enabled. 00:05:28.870 --> 00:05:31.260 If we want to actually skip this in the code, 00:05:31.380 --> 00:05:33.760 we want to copy this ID here, 00:05:34.540 --> 00:05:38.720 and then we'll need that for the next step so let's copy that 00:05:38.730 --> 00:05:41.260 and we'll go back to Visual Studio Code. 00:05:42.540 --> 00:05:45.730 Okay, so I'm back here in Visual Studio Code, 00:05:45.740 --> 00:05:49.050 and I've got my AWS S3 bucket resource, 00:05:49.440 --> 00:05:52.500 and if I wanted to skip the check on that resource, 00:05:53.040 --> 00:05:59.750 I'm going to add a new comment in here with the syntax ts:skip=, 00:05:59.750 --> 00:06:03.360 and then paste in the rule ID we just copied. 00:06:03.940 --> 00:06:07.230 Now, this will tell Terrascan that we want to skip this rule. 00:06:07.240 --> 00:06:10.930 You can add one of these lines for each rule you want to skip. 00:06:10.940 --> 00:06:15.070 But the other thing I would recommend you do with each of these is make sure 00:06:15.070 --> 00:06:19.390 you leave a little comment as to why it's been skipped so that if your code 00:06:19.390 --> 00:06:21.790 gets reviewed or there's some sort of audit, 00:06:21.800 --> 00:06:25.610 there's a justification for why this rule has been skipped in the first place. 00:06:25.710 --> 00:06:29.560 I'm going to go ahead and put in don't want a logging bucket on the demo. 00:06:31.230 --> 00:06:35.960 And then I'll save that, and let's rerun Terrascan and see what happens. 00:06:36.740 --> 00:06:37.900 So our scan's complete. 00:06:37.900 --> 00:06:40.250 You see we have no violated policies here. 00:06:40.350 --> 00:06:42.320 And if I expand the window a little bit, 00:06:42.320 --> 00:06:45.500 you'll see it does list it as a skipped violation, 00:06:45.510 --> 00:06:47.600 but it's not going to count that against us. 00:06:48.040 --> 00:06:50.190 So that's Terrascan from the command line. 00:06:50.200 --> 00:06:52.360 Let's take a look at some other ways we can run it. 00:06:52.940 --> 00:06:53.550 See you then.