Trivy newbie having problems with AWS scanning

[dave505]

Description

Hi,

I'm new to Trivy/Rego and I'm trying to write custom policies for our AWS environment. The issue I'm having is finding the documentation for the AWS inputs (for example input.aws.s3.buckets. I assume this is the same output as aws s3api list-buckets but I cannot find the documentation.

Please could you point me in the right direction?

Thanks

Link

No response

Suggestions

A list of AWS inputs with examples of the data format.

[nikpivkin]

Hi @dave505 !

Here you can read more about writing custom checks. You can also check out the existing Rego checks.

[itaysk]

This is the relevant documentation page: https://aquasecurity.github.io/trivy/v0.57/docs/scanner/misconfiguration/custom/schema/
but it's missing cloud schemas.
@simar7 I remember you were supposed to update the docs based on https://aquasecurity.github.io/trivy-schemas/

[nikpivkin]

Cloud scheme is mentioned in the documentation.

[dave505]

I'm trying to write a policy to check if certain tags have been applied to our ec2 instances. I see no mention of tags in the schema documentation linked above, how would I retrieve the tagging info so I can check for the these tags?

[nikpivkin]

Unfortunately this scheme is not extendible. What are you scanning? We recently added support for json/yaml scanning, so you can export data as json or yaml and write custom checks for it.

Example:

❯ awslocal s3api list-buckets > buckets.json

❯ cat buckets.json
{
    "Buckets": [
        {
            "Name": "test-bucket3",
            "CreationDate": "2024-11-20T11:15:59+00:00"
        }
    ],
    "Owner": {
        "DisplayName": "webfile",
        "ID": "75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a"
    }
}

❯ cat bucketname.rego
# METADATA
# custom:
#   avdid: AWS-USER-001
#   severity: LOW
package user.bucketname

import rego.v1

name := "test-bucket3"

deny contains res if {
    some bucket in input.Buckets
    bucket.Name == name
    res := result.new(sprintf("Bucket named %q is not allowed", [name]), {})
}%

❯ trivy conf buckets.json --misconfig-scanners json --config-check bucketname.rego --check-namespaces user
2024-11-20T17:28:06+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2024-11-20T17:28:07+06:00       WARN    [rego] Module has no input selectors - it will be loaded for all inputs!        file_path="Users/nikita/projects/trivy-test/diss-7926/bucketname.rego" module="Users/nikita/projects/trivy-test/diss-7926/bucketname.rego"
2024-11-20T17:28:07+06:00       INFO    Detected config files   num=1

buckets.json (json)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

 (LOW): Bucket named "test-bucket3" is not allowed
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────