https://github.com/rapid7/insightcloudsec-actions

https://github.com/rapid7/insightcloudsec-actions

Last synced: 12 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/rapid7/insightcloudsec-actions
• Owner: rapid7
• License: apache-2.0
• Created: 2022-07-01T13:35:40.000Z (about 4 years ago)
• Default Branch: master
• Last Pushed: 2024-01-24T12:13:06.000Z (over 2 years ago)
• Last Synced: 2024-12-18T06:23:40.135Z (over 1 year ago)
• Size: 12.7 KB
• Stars: 10
• Watchers: 10
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

          
![insightCloudSec](https://www.rapid7.com/globalassets/_logos/png/insightcloudsec-b-c.png)

# insightCloudSec Scan

The [insightCloudSec Scan](https://docs.divvycloud.com/docs/iac-cli-scanning-tool) Github Action allows security and development teams to integrate infrastructure-as-code (IaC) scanning in their CI/CD pipelines.

# About insightCloudSec

[insightCloudSec](https://www.rapid7.com/products/insightcloudsec/) secures your public cloud environment from development to production with a modern, integrated, and automated approach. 

# Usage

Two secrets need to be added for the action to work:

- `ICS_BASE_URL` - The URL of your InsightCloudSec server

- `ICS_API_KEY` - An InsightCloudSec API key

Read how to set secrets here: https://docs.github.com/en/actions/security-guides/encrypted-secrets

```yaml

- uses: rapid7/insightcloudsec-actions@latest

  with:

    # "ICS_API_KEY" secret

    api_key: ${{ secrets.ics_api_key }}

    # "ICS_BASE_URL" secret

    base_url: ${{ secrets.ics_base_url }}

    # Name of the IaC config you wish to scan with

    config_name: AWS CIS Benchmark 1.4

    # Optional file(s) to scan (default: all files in the repository excluding the .git/ directory)

    target: ./[^.git]*

```

An example workflow may look like this:

```yaml

on:

  pull_request:

    branches:

      - master

      - main

jobs:

  ics-scan-and-upload:

    name: insightCloudSec repository scan with Github Advanced Security

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4

      - name: Scan the repository

        uses: rapid7/insightcloudsec-actions@latest

        with:

          api_key: ${{ secrets.ics_api_key }}

          base_url: ${{ secrets.ics_base_url }}

          config_name: AWS CIS Benchmark 1.4

      # the following is optional but recommended to retrieve scan reports and logs

      - name: Attach scan artifacts

        if: always()

        uses: actions/upload-artifact@v4

        with:

          name: mimics-scan-artifacts

          path: |

            ./log/mimics*.log

            ./ics_scan.*

      # the following is optional but recommended to surface results to Github Advanced Security

      - name: Upload the sarif report to Github Advanced Security

        if: always()

        uses: github/codeql-action/upload-sarif@v2

        with:

          sarif_file: ics_scan.sarif

```