{"id":18524564,"url":"https://github.com/stelligent/aws-trend-micro-dssc","last_synced_at":"2026-02-12T10:04:29.237Z","repository":{"id":145834926,"uuid":"259921791","full_name":"stelligent/aws-trend-micro-dssc","owner":"stelligent","description":"An example of how to integrate Trend Micro Deep Security Smart Check with AWS CodePipeline","archived":false,"fork":false,"pushed_at":"2020-08-31T14:08:02.000Z","size":889,"stargazers_count":1,"open_issues_count":1,"forks_count":1,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-05-14T19:17:36.851Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stelligent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-29T12:40:39.000Z","updated_at":"2020-08-31T18:02:46.000Z","dependencies_parsed_at":"2024-07-30T08:33:53.936Z","dependency_job_id":null,"html_url":"https://github.com/stelligent/aws-trend-micro-dssc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stelligent/aws-trend-micro-dssc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws-trend-micro-dssc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws-trend-micro-dssc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws-trend-micro-dssc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws-trend-micro-dssc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stelligent","download_url":"https://codeload.github.com/stelligent/aws-trend-micro-dssc/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Faws-trend-micro-dssc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270989490,"owners_count":24680756,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-18T02:00:08.743Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T17:42:28.079Z","updated_at":"2026-02-12T10:04:24.218Z","avatar_url":"https://github.com/stelligent.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-trend-micro-dssc\n\nThis guide details steps and procedures you can follow to create, launch, and implement you own standalone container scanning solution within the AWS ecosystem.  This approach uses a commercial product by Trend Micro called [Deep Security Smart Check](https://www.trendmicro.com/en_us/business/products/hybrid-cloud/smart-check-image-scanning.html) (DSSC) as a proof-of-concept and provides examples of how integrate with AWS CodePipeline.\n\n## Pipeline Architecture\n\nHigh level overview of the pipeline architecture.\n\n![DSSC Pipeline High-Level Architecture](https://github.com/stelligent/aws-trend-micro-dssc/blob/master/docs/dssc_pipeline.png)\n\n## AWS Services Used\n\n- AWS CloudFormation\n- AWS ECR\n- AWS EKS\n- AWS ApiGateway\n- AWS Lambda\n- AWS Parameter Store\n- AWS CodePipeline\n- AWS CodeBuild\n- AWS CloudWatch\n\n## Getting Started\n\nThis application requires a few steps that must be executed as specified.  Please refer to the [prerequisites](#Prerequisites) section prior to running any commands contained in this article to ensure you have the required packages and software installed.\n\n__WARNING__: You may incur charges with the use of some of these AWS Services, specifically EKS if you leave your cluster up and running over time.\n\n### Prerequisites\n\nEnsure that the following are installed or configured on your workstation before deploying DSSC.\n\n- Git\n- Docker\n- AWS CLI\n- eksctl\n- helm\n- Make\n- jq\n\n### Installation\n\n- Clone this [repository](https://github.com/stelligent/aws-trend-micro-dssc)\n- Install and configure [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)\n- Install and configure [eksctl](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html)\n- Install and configure [helm](https://helm.sh/docs/intro/)\n\n## Deployments\n\n### Create EKS Cluster\n\nDSSC requires a Kubernetes cluster to run on so we’ll be using AWS EKS.\n\n```\nmake deploy-cluster\n```\n\nThis can take upwards of 15 minutes to create.\n\nThis command uses eksctl to create the cluster and two unmanaged nodes in preparation for the DSSC deployment.\n\n### Deploy DSSC\n\nDeploy DSSC to the EKS cluster created previously.  Once deployed, the default `password` will be changed to allow API access.\n\n```\nmake deploy-dssc\n```\n\nThis command uses helm to deploy DSSC to the cluster.  Detailed instructions are located at https://github.com/deep-security/smartcheck-helm.\n\nThere will be instructions output to the console on where and how to login to the DSSC administrative UI but it is not required for this example.\n\nThis command will create four AWS Parameter Store variables, all prefixed with `/pipeline/example/trendmicro/dssc`.\n- username - The DSSC username.\n- password - The newly changed DSSC password.\n- url - The URL for UI/API access.\n- secret - The secret phrase used to sign the X-Scan-Events-Signature header.\n\n### Create ECR Repository\n\nWe need an image repository to store our sample application image.  We will be using AWS ECR.\n\n```\nmake deploy-ecr\n```\n\nThis command will create an AWS ECR image repository.  This repository is used to house the sample app image which DSSC will use when a scan is initiated.\n\n### Push Sample Image\n\nWe need an image to scan so a sample has been provided.  To build and push it to the ECR repository we just created, run the following.\n\n```\nmake build-and-push-docker-image\n```\n\nThis will build a docker image using the application located in `./sample_app` and push it to the ECR repository created previously.\n\n### Create Webhook\n\nDSSC supports webhooks, which is a way for DSSC to communicate with other processes when certain events occur, like when a scan completes.  Leveraging a webhook is how we will integrate DSSC into our CI/CD pipeline. This means we need something for DSSC to call when scans are complete, so we will create a webhook for DSSC to call.\n\n```\nmake deploy-webhook\n```\n\nThis command creates an AWS ApiGateway, AWS Lambda, and an AWS SSM parameter storing the URL to access it.\n\nThe lambda code is in `cloudformation/webhook.yaml`.  This code takes the incoming JSON posted to it from DSSC and simply looks at the  `critical` and `high` errors counts in the JSON.  The code then approves or rejects the `Approve Deployment` pipeline action.  The code also checks the X-Scan-Event-Signature (using the DSSC Secret that was created with the deploy-dssc command) header to determine if the call is a valid one from DSSC.  A 401 is returned if the signature is invalid.  Refer to [Securing Web Hooks](https://github.com/deep-security/smartcheck-helm/wiki/Secure-web-hooks) for more information.\n\n### Create Pipeline\n\nNow we are ready to create the Pipeline.\n\n```\nmake deploy-pipeline\n```\n\nThis command creates an AWS CodePipeline pipeline and an AWS CloudWatch event rule.  The event rule will trigger the pipeline when new images are pushed to the ECR.\n\nThis pipeline has four stages\n- Source: Triggered by a new image uploaded to ECR and tagged ‘latest’.\n- Build: Calls DSSC API to initiate a new scan using the new image in ECR.\n- Approve Deployment: A manual approval step that is automatically set to Approve/Rejected by the DSSC scan.\n- Deployment: A mock deployment of the image.\n\nThe pipeline will trigger automatically upon creation.  Now move on to the Verification [#Verfication] section.\n\n\n## Verification\n\n### Pipeline\n\nWe have deployed everything and created our pipeline.  Now, let’s check the status.\nThis command displays the status of the different stages in the pipeline.\n\n```\nmake get-pipeline-status\n```\n\nConsole output:\n```\n=== Getting trend-mirco-dssc-pipeline Status ===\n-------------------------------------\n|         GetPipelineState          |\n+--------------------+--------------+\n|  Source            |  Succeeded   |\n|  Build             |  InProgress  |\n|  ApproveDeployment |  None      |\n|  Deploy            |  None        |\n+--------------------+--------------+\n```\n\nOnce the pipeline stage `ApproveDeployment` is Succeeded or Failed run the following command to get a description of the results.\n\n```\nmake get-pipeline-stage-result\n```\n\nConsole output:\n\n```\n=== Getting trend-mirco-dssc-pipeline stage 'ApproveDeployment' Summary ===\nThere are 3 critical issues and 22 high issues detected. Full results available at https://blah.us-east-1.elb.amazonaws.com/scans/aaf52a3d-d759-434a-a1c3-1de696197212\n```\n\n### DSSC\nYou can also check the scan status in DSSC at any time.\nThis command accesses DSSC via the API and retrieves the scan status.\n\n```\nmake get-scan-status\n```\n\nConsole output:\n\n```\n=== Getting DSSC Scan Status ===\naaf52a3d-d759-434a-a1c3-1de696197212: in-progress\n```\n\nThe output is `scan_id: status`.\n\nThe scan is complete when it shows a status of ‘complete-with-findings’ in this example.\nYou can view the full results by running the following:\n\n```\nmake get-scan-result\n```\n\n### Adjust Failure Tolerance\n\nBuilt into the Lambda code, is the ability to adjust the error tolerances for both critical and high errors.  We will now relax those settings in order to allow the pipeline to succeed and execute the deployment action.\n\n```\nmake adjust-error-tolerance\n```\n\n### Retrigger Pipeline\n\nNow that the error tolerances have been adjusted, retrigger the pipeline.\n\n```\nmake retrigger-pipeline\n```\n\nOnce the DSSC status `make get-scan-status` is showing ‘completed-with-findings’, rerun\n\n```\nmake get-pipeline-status\n```\n\nConsole output:\n\n```\n=== Getting trend-mirco-dssc-pipeline Status ===\n-------------------------------------\n|         GetPipelineState          |\n+--------------------+--------------+\n|  Source            |  Succeeded   |\n|  Build             |  Succeeded   |\n|  ApproveDeployment |  Succeeded   |\n|  Deploy            |  InProgress  |\n+--------------------+--------------+\n```\n\nTo view the pipeline stage comments, once again run\n\n```\nmake get-pipeline-stage-result\n```\n\nConsole output:\n```\n=== Getting trend-mirco-dssc-pipeline stage 'ApproveDeployment' Summary ===\nFull results available at https://blah.us-east-1.elb.amazonaws.com/scans/6526820b-f8e8-47ce-b528-9ed7319873b1\n```\n\n### Add Test Malware\n\nNow, let's intentionally introduce a test virus file and see what happens.  We have already relaxed the errors above to allow the pipeline to succeed.\n\n__WARNING__: This could trigger the Antivirus Scanner locally if one is running!  Please refer to https://www.eicar.org/?page_id=3950.\n\n```\nmake add-eicar-test-malware\n```\n\nThis command copies `./eicar/eicar_test_file.com` to `./sample_apps/src/eicar.com`.\n\nNow run `make build-and-deploy-docker-image` to build and deploy the image to trigger the pipeline.\n\nConsole Output for `make get-pipeline-stage-result` should (eventually) resemble:\n\n```\n=== Getting trend-mirco-dssc-pipeline stage 'ApproveDeployment' Summary ===\nThere are 1 malware issue(s) and 3 critical issue(s) detected. Full results available at https://blah.us-east-1.elb.amazonaws.com/scans/54eeb2a1-3408-4f06-97b4-8fb7211bdef0\n```\n\n## Clean-Up\n\nRemember to tear everything down to avoid excessive charges in your AWS account.\n\n```\nmake teardown\n```\n\n## Contributing\n\nNone yet\n\n## Versioning\n\nNone yet\n\n## License\n\nMIT Licencse Copyright (c) 2019 Mphasis-Stelligent, Inc. https://stelligent.com\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Faws-trend-micro-dssc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstelligent%2Faws-trend-micro-dssc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Faws-trend-micro-dssc/lists"}