Trivy

# Trivy IaC (Infrastructure as Code) 및 설정 스캔

# 1. Terraform 스캔
trivy config /path/to/terraform/
trivy config --tf-vars terraform.tfvars /path/to/terraform/

# 2. Kubernetes 매니페스트 스캔
trivy config /path/to/k8s-manifests/
trivy config deployment.yaml

# 3. Dockerfile 스캔
trivy config --file-patterns "Dockerfile" /path/to/project/

# 4. Helm 차트 스캔
trivy config /path/to/helm-chart/

# 5. CloudFormation 스캔
trivy config /path/to/cloudformation/

# 6. 모든 설정 오류 종류 표시
trivy config --severity LOW,MEDIUM,HIGH,CRITICAL /path/to/config/

# 예시: 발견되는 설정 오류
# - Dockerfile에서 root 사용자로 실행
# - Kubernetes에서 privileged 컨테이너
# - Terraform에서 S3 버킷 암호화 미설정
# - 민감한 환경 변수 하드코딩

# 7. 커스텀 정책 적용 (Rego)
# policies/custom-policy.rego
cat << 'EOF' > policies/no-latest-tag.rego
package appshield.kubernetes.KS001

deny[msg] {
    input.kind == "Deployment"
    container := input.spec.template.spec.containers[_]
    endswith(container.image, ":latest")
    msg := sprintf("Container '%s' uses 'latest' tag", [container.name])
}
EOF

trivy config --policy policies/ /path/to/k8s-manifests/

# 8. 특정 체크 비활성화
trivy config --skip-files "*.test.yaml" /path/to/config/
trivy config --skip-dirs "tests/" /path/to/config/

# 9. Kubernetes 클러스터 직접 스캔
trivy k8s --report summary cluster
trivy k8s --report all --namespace default cluster

# 10. 취약한 Dockerfile 예시와 수정

# 취약한 Dockerfile:
# FROM ubuntu:latest
# RUN apt-get update && apt-get install -y curl
# COPY app /app
# USER root
# CMD ["/app"]

# Trivy 결과:
# - DS001: 'latest' 태그 사용
# - DS002: root 사용자로 실행
# - DS006: apt-get update 후 별도 레이어에서 install

# 수정된 Dockerfile:
# FROM ubuntu:22.04
# RUN apt-get update && apt-get install -y --no-install-recommends curl \
#     && rm -rf /var/lib/apt/lists/*
# RUN useradd -m appuser
# COPY --chown=appuser:appuser app /app
# USER appuser
# CMD ["/app"]

# GitHub Actions - Trivy 통합

name: Security Scan with Trivy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      # 컨테이너 이미지 취약점 스캔
      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-image-results.sarif'
          severity: 'CRITICAL,HIGH'

      # IaC 스캔 (Terraform, Kubernetes 등)
      - name: Scan IaC for misconfigurations
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-config-results.sarif'

      # 파일시스템 스캔 (의존성 취약점)
      - name: Scan filesystem for vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-fs-results.sarif'

      # GitHub Security 탭에 결과 업로드
      - name: Upload scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-image-results.sarif'

      # SBOM 생성
      - name: Generate SBOM
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'cyclonedx'
          output: 'sbom.json'

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

---
# GitLab CI - Trivy 통합

stages:
  - build
  - scan

variables:
  IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

build:
  stage: build
  script:
    - docker build -t $IMAGE_NAME .
    - docker push $IMAGE_NAME

trivy-scan:
  stage: scan
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    # 이미지 취약점 스캔
    - trivy image --exit-code 0 --severity HIGH,CRITICAL $IMAGE_NAME
    - trivy image --exit-code 1 --severity CRITICAL $IMAGE_NAME
  allow_failure: false

trivy-config-scan:
  stage: scan
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy config --exit-code 1 --severity HIGH,CRITICAL .
  allow_failure: true  # 설정 오류는 경고만

---
# Trivy Operator (Kubernetes)

# 1. 설치
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update
helm install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace

# 2. VulnerabilityReport 조회
kubectl get vulnerabilityreports -A

# 3. 특정 워크로드의 취약점 확인
kubectl get vulnerabilityreport -n default -l trivy-operator.resource.name=nginx

# 4. ConfigAuditReport 조회 (설정 오류)
kubectl get configauditreports -A

# 5. RBAC 리포트
kubectl get rbacassessmentreports -A