CCM-9061 Replace TFSec with Trivy (#62)

* CCM-9061 Replace TFSec with Trivy

* CCM-9061 trigger trivy scan test

* CCM-9061 trigger trivy scan test

Author: aidenvaines-cgi

.github/actions/tfsec/action.yaml .github/actions/trivy/action.yaml.github/actions/tfsec/action.yaml renamed to .github/actions/trivy/action.yaml

@@ -1,18 +1,17 @@
-name: "TFSec Scan"
-description: "Scan HCL using TFSec"
+name: "Trivy Scan"
 runs:
   using: "composite"
   steps:
-    - name: "TFSec Scan - Components"
+    - name: "Trivy Terraform IAC Scan"
       shell: bash
       run: |
         components_exit_code=0
         modules_exit_code=0
 
-        ./scripts/terraform/tfsec.sh ./infrastructure/terraform/components || components_exit_code=$?
-        ./scripts/terraform/tfsec.sh ./infrastructure/terraform/modules || modules_exit_code=$?
+        ./scripts/terraform/trivy.sh ./infrastructure/terraform/components || components_exit_code=$?
+        ./scripts/terraform/trivy.sh ./infrastructure/terraform/modules || modules_exit_code=$?
 
         if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
-          echo "One or more TFSec scans failed."
+          echo "Trivy misconfigurations detected."
           exit 1
         fi

.github/workflows/stage-1-commit.yaml

@@ -135,8 +135,8 @@ jobs:
         uses: actions/checkout@v4
       - name: "Lint Terraform"
         uses: ./.github/actions/lint-terraform
-  tfsec:
-    name: "TFSec Scan"
+  trivy:
+    name: "Trivy Scan"
     runs-on: ubuntu-latest
     timeout-minutes: 5
     needs: detect-terraform-changes
@@ -148,8 +148,8 @@ jobs:
         uses: asdf-vm/actions/setup@v3
       - name: "Perform Setup"
         uses: ./.github/actions/setup
-      - name: "TFSec Scan"
-        uses: ./.github/actions/tfsec
+      - name: "Trivy Scan"
+        uses: ./.github/actions/trivy
   count-lines-of-code:
     name: "Count lines of code"
     runs-on: ubuntu-latest

.tool-versions

@@ -3,7 +3,7 @@ gitleaks 8.24.0
 pre-commit 3.6.0
 terraform 1.9.2
 terraform-docs 0.19.0
-tfsec 1.28.10
+trivy 0.61.0
 vale 3.6.0
 python 3.13.2
 

infrastructure/terraform/components/acct/cloudwatch_log_group_route53_query_log.tf

@@ -31,7 +31,7 @@ data "aws_iam_policy_document" "route53_logs" {
 
     resources = [
       aws_cloudwatch_log_group.aws_route53_query_log.arn,
-      "${aws_cloudwatch_log_group.aws_route53_query_log.arn}:*"
+      "${aws_cloudwatch_log_group.aws_route53_query_log.arn}:*",
     ]
   }
 }

infrastructure/terraform/components/acct/iam_policy_github_deploy_overload.tf

@@ -9,7 +9,7 @@ resource "aws_iam_role_policy_attachment" "github_deploy_overload" {
   policy_arn = aws_iam_policy.github_deploy_overload.arn
 }
 
-#tfsec:ignore:aws-iam-no-policy-wildcards Policy voilation expected for CI user role
+#trivy:ignore:aws-iam-no-policy-wildcards Policy voilation expected for CI user role
 data "aws_iam_policy_document" "github_deploy" {
   statement {
     effect = "Allow"

scripts/config/tfsec.yaml

@@ -0,0 +1,6 @@
+---
+severity: MEDIUM              # Minimum reported findings
+exit-code: 1                  # When issues are found
+scan:
+  skip-files:
+    - "**/.terraform/**/*"

scripts/config/trivy.yaml

@@ -9,7 +9,7 @@ set -euo pipefail
 # Run tfsec for security checks on Terraform code.
 #
 # Usage:
-#   $ ./tfsec.sh [directory]
+#   $ ./trivy.sh [directory]
 # ==============================================================================
 
 function main() {
@@ -18,68 +18,63 @@ function main() {
 
   local dir_to_scan=${1:-.}
 
-  if command -v tfsec > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
+  if command -v trivy > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
     # shellcheck disable=SC2154
-    run-tfsec-natively "$dir_to_scan"
+    run-trivy-natively "$dir_to_scan"
   else
-    run-tfsec-in-docker "$dir_to_scan"
+    run-trivy-in-docker "$dir_to_scan"
   fi
 }
 
-# Run tfsec on the specified directory.
+# Run trivy on the specified directory.
 # Arguments:
 #   $1 - Directory to scan
-function run-tfsec-natively() {
+function run-trivy-natively() {
 
   local dir_to_scan="$1"
 
-  echo "TFSec found locally, running natively"
+  echo "Trivy found locally, running natively"
 
-  echo "Running TFSec on directory: $dir_to_scan"
-  tfsec \
-    --force-all-dirs \
-    --exclude-downloaded-modules \
-    --config-file scripts/config/tfsec.yaml \
-    --format text \
-    "$dir_to_scan"
+  echo "Running Trivy on directory: $dir_to_scan"
+  trivy config \
+    --config scripts/config/trivy.yaml \
+    --tf-exclude-downloaded-modules \
+    "${dir_to_scan}"
 
-  check-tfsec-status
+  check-trivy-status
 }
 
 # Check the exit status of tfsec.
-function check-tfsec-status() {
+function check-trivy-status() {
 
   if [ $? -eq 0 ]; then
-    echo "TFSec completed successfully."
+    echo "Trivy completed successfully."
   else
-    echo "TFSec found issues."
+    echo "Trivy found issues."
     exit 1
   fi
 }
 
-function run-tfsec-in-docker() {
+function run-trivy-in-docker() {
 
   # shellcheck disable=SC1091
   source ./scripts/docker/docker.lib.sh
   local dir_to_scan="$1"
 
   # shellcheck disable=SC2155
-  local image=$(name=aquasec/tfsec docker-get-image-version-and-pull)
+  local image=$(name=aquasec/trivy docker-get-image-version-and-pull)
   # shellcheck disable=SC2086
-  echo "TFSec not found locally, running in Docker Container"
-  echo "Running TFSec on directory: $dir_to_scan"
+  echo "Trivy not found locally, running in Docker Container"
+  echo "Running Trivy on directory: $dir_to_scan"
   docker run --rm --platform linux/amd64 \
     --volume "$PWD":/workdir \
     --workdir /workdir \
     "$image" \
-        --concise-output \
-        --force-all-dirs \
-        --exclude-downloaded-modules \
-        --config-file scripts/config/tfsec.yaml \
-        --format text \
-        --soft-fail \
-        "$dir_to_scan"
-    check-tfsec-status
+    config \
+    --config scripts/config/trivy.yaml \
+    --tf-exclude-downloaded-modules \
+    "${dir_to_scan}"
+    check-trivy-status
 }
 # ==============================================================================