CI/CD Integration

1name: Cloud Security Scan
2on:
3  pull_request:
4    branches: [main]
5  schedule:
6    - cron: '0 6 * * *'  # Daily at 6 AM
7 
8jobs:
9  cloudsploit-scan:
10    runs-on: ubuntu-latest
11    steps:
12      - name: Checkout repo
13        uses: actions/checkout@v3
14 
15      - name: Setup Node.js
16        uses: actions/setup-node@v3
17        with:
18          node-version: '18'
19 
20      - name: Install Cloudsploit
21        run: npm install -g @aquasecurity/cloudsploit
22 
23      - name: Configure AWS credentials
24        uses: aws-actions/configure-aws-credentials@v2
25        with:
26          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
27          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
28          aws-region: us-east-1
29 
30      - name: Run Cloudsploit scan
31        run: |
32          cloudsploit scan aws \
33            --services iam,s3,ec2 \
34            --severity critical,high \
35            --output json \
36            --outfile results.json
37 
38      - name: Upload results
39        uses: actions/upload-artifact@v3
40        with:
41          name: cloudsploit-results
42          path: results.json
43 
44      - name: Fail on critical issues
45        run: |
46          if grep -q '"severity":"CRITICAL"' results.json; then
47            echo "Critical security issues found!"
48            cat results.json
49            exit 1
50          fi

1stages:
2  - security
3 
4cloudsploit-scan:
5  stage: security
6  image: node:18
7  before_script:
8    - npm install -g @aquasecurity/cloudsploit
9  script:
10    - cloudsploit scan aws \
11        --services iam,s3,ec2,rds \
12        --severity high,critical \
13        --output json \
14        --outfile results.json
15    - |
16      if grep -q '"severity":"CRITICAL"' results.json; then
17        echo "Critical security issues found!"
18        exit 1
19      fi
20  artifacts:
21    paths:
22      - results.json
23    expire_in: 1 week
24  rules:
25    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
26    - if: $CI_COMMIT_BRANCH == "main"
27      when: schedule

1pipeline {
2  agent any
3 
4  environment {
5    CLOUDSPLOIT_HOME = tool name: 'cloudsploit', type: 'com.aquasecurity.cloudsploit'
6    AWS_ACCESS_KEY_ID = credentials('aws-access-key-id')
7    AWS_SECRET_ACCESS_KEY = credentials('aws-secret-access-key')
8  }
9 
10  stages {
11    stage('Install Cloudsploit') {
12      steps {
13        sh 'npm install -g @aquasecurity/cloudsploit'
14      }
15    }
16 
17    stage('Security Scan') {
18      steps {
19        sh '''
20          cloudsploit scan aws \
21            --services iam,s3,ec2 \
22            --severity critical,high \
23            --output junit \
24            --outfile results.xml
25        '''
26      }
27    }
28 
29    stage('Publish Results') {
30      steps {
31        junit 'results.xml'
32        archiveArtifacts artifacts: 'results.json', fingerprint: true
33      }
34    }
35  }
36 
37  post {
38    always {
39      cleanWs()
40    }
41  }
42}

1trigger:
2  - main
3  - develop
4 
5schedules:
6  - cron: "0 6 * * *"
7    displayName: Daily 6 AM scan
8    branches:
9      include:
10        - main
11 
12pool:
13  vmImage: 'ubuntu-latest'
14 
15steps:
16  - task: NodeTool@0
17    inputs:
18      versionSpec: '18.x'
19    displayName: 'Install Node.js'
20 
21  - script: npm install -g @aquasecurity/cloudsploit
22    displayName: 'Install Cloudsploit'
23 
24  - task: AWSCLI@1
25    inputs:
26      awsCredentials: 'AWS-Service-Connection'
27      regionName: 'us-east-1'
28    displayName: 'Configure AWS credentials'
29 
30  - script: |
31      cloudsploit scan aws \
32        --services iam,s3,ec2 \
33        --severity critical \
34        --output json \
35        --outfile results.json
36    displayName: 'Run Cloudsploit scan'
37 
38  - task: PublishBuildArtifacts@1
39    inputs:
40      PathtoPublish: 'results.json'
41      ArtifactName: 'security-scan'
42    displayName: 'Publish results'