This project provides an interface for submitting infrastructure as code (IaC) templates to Skyhigh Security CSPM for configuration audit. Simply map the location of your CloudFormation, Azure Resource Manager (ARM) to the container and pass the list of files you wish to be inspected.
In your Skyhigh SSE console, create a user with at least the following permissions: Policy Management/Configuration Audit Policy Management/On-Demand Scan Incident Management
If you are using a SSO solution with Skyhigh, configure an exclusion for this user Under User Management / SAML configuration.
First, generate a comma separated list of files to be submitted to Skyhigh for inspection relative to path that you will map to the container's /data path. Next, place this list and your Skyhigh username and password, the name of the target IaaS provider, and Skyhigh environment URL into environment variables as follows:
SKYHIGH_USERNAME: Your Skyhigh username / email address
SKYHIGH_PASSWORD: Your Skyhigh password
IAAS_PROVIDER: The name of the IAAS provider which tells Skyhigh which active policies to evaluate against. Valid options are: aws, gcp, azure.
DATA: Comma separated list of files to scan (relative to the container's /data volume)
SKYHIGH_ENV: The region-specific base-url for the Skyhigh API. Valid options include: https://www.myshn.net , https://www.myshn.eu , and https://www.myshn.ca. Generally this URL will be displayed when you are logged into your Skyhigh dashboard.
Finally, execute the docker run command mapping the /data volume and passing the environment variables as parameters in this specific order:
$DATA $SKYHIGH_USERNAME $SKYHIGH_PASSWORD "/data" $IAAS_PROVIDER $SKYHIGH_ENV
The example script below, when executed within that path, will find all .yaml, .yml, .json, and .tf files and write the list to iac-inspection.txt. It then sanitized the file list of extra characters, sets the environment variables, and executes the docker command.
#!/bin/bash
find ./ -type f \( -iname "*.yaml" -o -iname "*.yml" -o -iname "*.tf" -o -iname "*.json" \) > iac-inspection.txt
if test "$( wc -l < iac-inspection.txt )" -gt 0; then
DATA=$(cat iac-inspection.txt | while read line; do echo $line; done)
DATA=$(echo $DATA | tr ' ' ',')
SKYHIGH_USERNAME=user@domain.com
SKYHIGH_PASSWORD=your_password
IAAS_PROVIDER="aws" # Tells Skyhigh which set of active CSPM policies to execute against. Valid options are aws, gcp, or azure.
SKYHIGH_ENV="https://www.myshn.net"
docker run -v /path/to/iac/files:/data ghcr.io/skyhighsecurity/shiftleft-docker-image:latest $DATA $SKYHIGH_USERNAME $SKYHIGH_PASSWORD "/data" $IAAS_PROVIDER $SKYHIGH_ENV
fiThis is presently not supported.
Absolutely. See the project's source code for examples of how to do this using Python.