Infrastructure as Code (IaC) makes creating, managing and collaborating around cloud infrastructure easier. DevSecOps provides automated tools and shifts left the security to the developer. This shift left allows security and compliance to be part of the development process, and not an afterthought in production. Security becomes part of the whole DevOps lifecycle, leading to a more secure product in production.
To facilitate the shift left, tools that scan IaC for compliance and vulnerabilities need to be available to the software development team. These tools are used to check code prior to check-in for your source code repository and after check-in to your source code repository for your code review.
It is important to understand how Prisma Cloud Code Security can integrate into your development lifecycle through the coding and building phases to ensure repeatable code in your runtime environment infrastructure.
Figure 1: Development Lifecycle_palo-alto-networks
Git Operations or GitOps is a method for managing infrastructure and application deployments as code, using Git as a single source of truth. In cloud computing, GitOps can be used to maintain the desired state of an infrastructure in a Git repository, and continuously synchronize it with the actual state of the infrastructure.
In typical GitOps setups, all infrastructure state is maintained via a continuous deployment pipeline. The deployment pipeline is triggered by changes pushed to the source code repository, automatically applying the desired state to the infrastructure, ensuring that it remains in a consistent and predictable state. This makes it easier to manage and maintain infrastructure, as all changes are version controlled, auditable, and reversible.
Figure 2: General GitOps workflow_palo-alto-networks
A typical Git operation for submitting a pull request (PR) against an infrastructure as code repository follows the following steps:
In a GitOps workflow, all changes to the infrastructure are version-controlled and auditable, making it easier to track changes, collaborate, and ensure the infrastructure is always in a desired state. When there are issues, the infrastructure can be rolled-back to a known good state.
Adding a static scanning tool into your GitOps workflow can improve the quality of code produced by detecting issues early in the development process and automatically enforcing best practices and coding standards. Some benefits of using a static scanning tool include:
Prisma Cloud Code Security (CCS) can detect and prevent cybersecurity risks in infrastructure code before it is deployed. By adding the command line tool checkov to their workflow, developers can inspect their infrastructure code even before it is submitted as a pull request. Furthermore, checkov can be integrated with the CI/CD pipeline and perform analysis on infrastructure code and terminate the pipeline if critical errors are detected before the code is handed to the orchestrator of choice.
Figure 3: GitOps workflow protected with CCS_palo-alto-networks
There are 3 ways to incorporate infrastructure code scanning in your workflow as a developer:
Let’s review the setting up the developer’s environment, as this is usually the first step new users take to get themselves familiarized with CCS.
|
export PRISMA_ACCESS_KEY_ID=<your-value-here> export PRISMA_SECRET_KEY=<your-value-here> export PRISMA_API_URL=https://api<your-value-here>.prismacloud.io export BC_API_KEY=${PRISMA_ACCESS_KEY_ID}::${PRISMA_SECRET_KEY} |
Now you are ready to install checkov.
|
pip3 install -U –user checkov |
As long as you have sourced you bash or zsh profile file, you can change into the directory with your infrastructure code and run your first manual scan:
|
cd <your-value-here> checkov -d . |
Prisma Cloud documentation documenting this process.
Once you have checkov integrated with your workflow and have performed some scans, you should be able to see results in the CCS console:
Figure 4: Scan results in CCS console_palo-alto-networks
Your VCS will have PR comments plus the ability to automatically submit code fix PRs for some of the violations:
Figure 5: PR comments and fixes in your VCS_palo-alto-networks
Along with the benefits of code scanning / compliance, CCS also offers:
Prisma Cloud Code Security offers various comprehensive benefits to support the development lifecycle of your organization’s infrastructure as outlined above.
Julian Neytchev is a Sr Cloud Security Engineer on the Prisma Cloud SWAT team, specializing in Cloud Application Security. Julian uses collaborative approaches to break down complex problems into solutions for global enterprise customers and leverage his vast industry knowledge to inspire success.
