Replies: 3 comments 10 replies
-
|
Thanks for the report, are you able to share a small snippet of the input so we can try to reproduce it? |
Beta Was this translation helpful? Give feedback.
-
|
here is demo snippet for which the scanner is also not working. {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string",
"defaultValue": "myVM"
},
"adminUsername": {
"type": "string",
"defaultValue": "adminUser"
},
"adminPassword": {
"type": "securestring"
}
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2022-09-01",
"name": "[parameters('vmName')]",
"location": "[resourceGroup().location]",
"properties": {
"hardwareProfile": {
"vmSize": "Standard_D2s_v3"
},
"storageProfile": {
"imageReference": {
"publisher": "MicrosoftWindowsServer",
"offer": "WindowsServer",
"sku": "2016-Datacenter",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage"
}
},
"osProfile": {
"computerName": "[parameters('vmName')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]"
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', concat(parameters('vmName'), 'NIC'))]"
}
]
}
}
}
]
} |
Beta Was this translation helpful? Give feedback.
-
|
tried this as well, but no luck:
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks. I'll create an issue from this. |
Beta Was this translation helpful? Give feedback.
-
|
Track #6126 |
Beta Was this translation helpful? Give feedback.
-
In this case yes. |
Beta Was this translation helpful? Give feedback.
-
|
@dMeshko what misconfigurations do you expect to see in this case? AFAICT, I don't see any misconfigs in the test input you've supplied. |
Beta Was this translation helpful? Give feedback.
-
|
I guess I was expecting for the configuration files to be acknowledged that they were picked up for scanning. No misconfiguration expected, did not got to that point. |
Beta Was this translation helpful? Give feedback.
-
|
If we take template below for example, shouldn't trivy raise an event that I am exposing a secret as an output? (bicep/arm template compiler raises this error). demo output: Warning outputs-should-not-contain-secrets: Outputs should not contain secrets. Found possible secret: secure value 'secretValue' [https://aka.ms/bicep/linter/outputs-should-not-contain-secrets]demo template: {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.25.3.34343",
"templateHash": "2541516294529324558"
}
},
"parameters": {
"keyVaultName": {
"type": "string"
},
"secretName": {
"type": "string",
"metadata": {
"description": "Specifies the secret name"
}
},
"secretValue": {
"type": "securestring",
"metadata": {
"description": "Specifies the secret value"
}
},
"tags": {
"type": "object",
"defaultValue": {},
"metadata": {
"description": "[Optional] Secret tags"
}
},
"contentType": {
"type": "string",
"defaultValue": "",
"metadata": {
"description": "[Optional] Specifies the secret contentType"
}
}
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults/secrets",
"apiVersion": "2023-07-01",
"name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretName'))]",
"tags": "[parameters('tags')]",
"properties": {
"value": "[parameters('secretValue')]",
"contentType": "[parameters('contentType')]"
}
}
],
"outputs": {
"secretUri": {
"type": "string",
"value": "[reference(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretName')), '2023-07-01').secretUri]"
},
"secretUriWithVersion": {
"type": "string",
"value": "[reference(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretName')), '2023-07-01').secretUriWithVersion]"
},
"scrtExample": {
"type": "string",
"value": "[parameters('secretValue')]"
}
}
} |
Beta Was this translation helpful? Give feedback.
-
|
Secret scanning is separate from misconfiguration scanning within Trivy. You can read the docs for secret scanning here |
Beta Was this translation helpful? Give feedback.
-
|
Hi @dMeshko ! Trivy successfully scans the ARM template. I think the message @simar7 The issue is that the Azure state for the scan was empty and no checks were applied to it, so Trivy reported that 0 configs were detected. |
Beta Was this translation helpful? Give feedback.
-
|
Yes as discussed offline, we can change the messaging to be less confusing. |
Beta Was this translation helpful? Give feedback.
-
|
Perfect, thank you for the quick response! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
I am trying to scan my ARM IaC templates, but trivy is failing to detect them. The original templates are written in bicep, but then are compiled to ARM for scanning purposes.
Desired Behavior
My ARM templates to be detected and checked for vulnerabilities.
Actual Behavior
Trivy did not detect any ARM templates (even though they are compiled and present).
Reproduction Steps
Target
None
Scanner
Misconfiguration
Output Format
Table
Mode
Standalone
Debug Output
Operating System
Ubuntu 22.04.3 LTS (Jammy Jellyfish)
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions