WEBVTT 00:00:03.140 --> 00:00:03.510 Okay, 00:00:03.510 --> 00:00:07.530 I'm back here in Visual Studio Code, and I've reverted the changes 00:00:07.530 --> 00:00:10.660 that I talked about in the last video because I want them to show up 00:00:10.670 --> 00:00:13.500 on the GitHub action when I run the check. 00:00:13.520 --> 00:00:17.750 So, actually, let's go here under the .github/workflows folder, 00:00:17.760 --> 00:00:22.730 there's a configuration file here called terrascan.yml, and I'll leave a 00:00:22.730 --> 00:00:26.620 link to this in the README as well, but this is the Terrascan GitHub 00:00:26.630 --> 00:00:29.350 action with a few different options specified. 00:00:29.450 --> 00:00:34.200 I've got my iac_type, or Infrastructure as Code typeset as Terraform, and 00:00:34.200 --> 00:00:39.820 I'm looking at AWS policies. The only_warn flag here on line 17 will mean 00:00:39.820 --> 00:00:43.710 that the job will pass even if there are errors detected. And then, 00:00:43.720 --> 00:00:48.130 there's another one at the bottom, serif_upload, on line 18, which is 00:00:48.130 --> 00:00:52.860 followed up by a Upload SARIF file GitHub action. And I'll go into a 00:00:52.860 --> 00:00:56.720 little bit more detail about that in just a moment, but you can get a full 00:00:56.720 --> 00:01:00.790 list of each of the flags that you can run on this option on the GitHub 00:01:00.790 --> 00:01:04.440 Actions page for it. Like I said, I'll leave a note to that in the README 00:01:04.440 --> 00:01:08.000 file. For now, let's go over to GitHub and watch it run. 00:01:08.300 --> 00:01:11.050 I'll pause the video here and open up the new page. 00:01:12.240 --> 00:01:16.260 So this is the GitHub repository for the demo code I'm using, and 00:01:16.260 --> 00:01:19.890 I'll go ahead and tab over to Actions, and you see it's already run 00:01:19.890 --> 00:01:23.300 once because I did push to this branch when I first set up the 00:01:23.300 --> 00:01:28.210 repository, and I have the action set up to scan on push. But I can 00:01:28.210 --> 00:01:32.640 go over here to the action and then I will click Re‑run all jobs so 00:01:32.640 --> 00:01:33.690 we can see it again. 00:01:33.820 --> 00:01:39.430 Now this is going to essentially download Terrascan in a Docker container, 00:01:39.660 --> 00:01:43.190 and then run it against the code in this repository. 00:01:43.190 --> 00:01:46.220 So we'll pause the video here for a minute and then 00:01:46.220 --> 00:01:47.710 resume it when the scan is done. 00:01:49.140 --> 00:01:53.360 All right, so you see now the scan has run, its finished green, and I want to 00:01:53.360 --> 00:01:59.460 go over a few things first. Number one, if we go over to the Run Terrascan, 00:01:59.460 --> 00:02:03.560 this is actually showing you the policy violations that we saw in the previous 00:02:03.560 --> 00:02:07.690 demo, and it's showing you the commands that it's running too. So this is just 00:02:07.690 --> 00:02:12.510 running the terrascan scan command with a few different flags in a container, 00:02:12.510 --> 00:02:13.590 like I said earlier. 00:02:13.740 --> 00:02:18.300 Next, actually, is the Upload SARIF file, which, if you remember, we 00:02:18.300 --> 00:02:22.570 had this flag enabled on the Terrascan action and that generated a 00:02:22.570 --> 00:02:26.450 SARIF file called terrascan.sarif, and then uploaded the results to 00:02:26.450 --> 00:02:31.530 GitHub. So what does that mean for us? So, if I go up here to my GitHub 00:02:31.530 --> 00:02:36.000 repository and then go over to Security, you'll see I've got some code 00:02:36.000 --> 00:02:40.380 scanning alerts here on the left‑hand side that weren't there a minute 00:02:40.380 --> 00:02:40.820 ago. 00:02:41.100 --> 00:02:44.600 And GitHub has this feature where if you have a public 00:02:44.600 --> 00:02:48.540 repository or GitHub enterprise, then you can upload a SARIF 00:02:48.540 --> 00:02:51.840 file if any security vulnerabilities are detected, and it will 00:02:51.850 --> 00:02:54.460 open up new security issues for each. 00:02:54.640 --> 00:02:58.430 So you'll see I've got the same two issues that we had earlier, the S3 00:02:58.430 --> 00:03:02.430 versioning, which is marked as an error here because it was a high priority 00:03:02.430 --> 00:03:06.130 in Terrascan, and the access logging, which is a warning because it was a 00:03:06.130 --> 00:03:11.870 medium priority error in Terrascan. So, I can open this up and I'll see this 00:03:11.870 --> 00:03:16.100 is the rule it's violating and this is the line it was detected on in my 00:03:16.100 --> 00:03:20.450 repository. And from here, I can even create a new issue, so let's create an 00:03:20.450 --> 00:03:21.210 issue here. 00:03:21.300 --> 00:03:23.590 I want to fix my access logging, 00:03:23.650 --> 00:03:26.930 I'll submit the new issue for now, and now I can start 00:03:26.930 --> 00:03:29.530 work on fixing that issue in my code. 00:03:29.710 --> 00:03:33.860 So this is how you can use Terrascan as a GitHub action in order to 00:03:33.870 --> 00:03:38.650 automatically flag and mark issues in your infrastructure configuration. 00:03:38.740 --> 00:03:41.710 And then from here, you can set out on whatever your organization's 00:03:41.710 --> 00:03:44.720 process is to check in new code to resolve those issues. 00:03:45.100 --> 00:03:48.500 I've got two other configurations for Terrascan I want to show you, 00:03:48.940 --> 00:03:51.460 but let's go ahead and do that in the next video. 00:03:51.840 --> 00:03:52.480 I'll see you there.