CNAPP

# CNAPP 통합 파이프라인 예시 (GitHub Actions + Wiz CLI)
name: CNAPP Security Pipeline

on:
  push:
    branches: [main]
  pull_request:

jobs:
  cnapp-scan:
    runs-on: ubuntu-latest
    steps:
      # 1. IaC 보안 스캔 (Shift-Left)
      - name: Terraform Security Scan
        uses: wiz-sec/wiz-cli-action@v1
        with:
          scan-type: iac
          path: ./terraform
          policy: "High severity findings block"

      # 2. 컨테이너 이미지 취약점 스캔
      - name: Container Image Scan
        run: |
          wiz-cli docker scan ${{ env.IMAGE_TAG }} \
            --policy "Critical CVE blocks" \
            --output sarif > container-scan.sarif

      # 3. 시크릿 탐지
      - name: Secret Detection
        run: |
          wiz-cli secrets scan ./src \
            --exclude ".git,node_modules"

      # 4. SBOM 생성 및 업로드
      - name: Generate SBOM
        run: |
          syft ${{ env.IMAGE_TAG }} -o spdx-json > sbom.json
          wiz-cli sbom upload --sbom sbom.json

# 런타임 보호 정책 (Kubernetes)
# wiz-runtime-policy.yaml
apiVersion: wiz.io/v1
kind: RuntimePolicy
metadata:
  name: production-workload-protection
spec:
  scope:
    namespaces: ["production"]
  rules:
    - name: block-privileged-containers
      action: Block
    - name: detect-crypto-mining
      action: Alert
    - name: prevent-lateral-movement
      action: Block