Bicep + KICS (Docker) でAzure リソースの脆弱性を検出する

.
└── bicep
    └── main.bicep

param location string = resourceGroup().location
param sku string = 'F1'
param linuxFxVersion string = 'node|20-lts'
param administratorLogin string = 'sqluser'
param administratorLoginPassword string = '!WFER93jqFede'

// App Service Planを作成
resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = {
  name: 'asp-kicsbiceptest'
  location: location
  properties: {
    reserved: true
  }
  sku: {
    name: sku
  }
  kind: 'linux'
}

// App Serviceを作成
resource appService 'Microsoft.Web/sites@2023-12-01' = {
  name: 'app-kicsbiceptest'
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    siteConfig: {
      linuxFxVersion: linuxFxVersion
    }
  }
}

// SQL Serverを作成
resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
  name: 'sql-kicsbiceptest'
  location: location
  properties: {
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
  }
}

// SQL Databaseを作成
resource sqlDB 'Microsoft.Sql/servers/databases@2023-08-01-preview' = {
  parent: sqlServer
  name: 'sqldb-kicsbiceptest'
  location: location
  sku: {
    name: 'Standard'
    tier: 'Standard'
  }
}

# KICSイメージを取得する
docker pull checkmarx/kics:latest

docker run -t -v <スキャンするフォルダ名>:<コンテナ内で使うフォルダ名> checkmarx/kics scan -p <コンテナ内で使うフォルダ名> -o "<結果のファイルを出力するパス>"

# KICSでBicepテンプレートファイルをチェックする
docker run -t -v ./bicep:/path checkmarx/kics scan -p /path -o "/path/"

docker run -t -v ./bicep:/path checkmarx/kics scan -p /path/main.bicep -o "/path/"

testuser@windowspc:~/test$ docker run -t -v ./bicep:/path checkmarx/kics scan -p /path/ -o "/path/"

<省略>

Scanning with Keeping Infrastructure as Code Secure v2.1.2


Preparing Scan Assets: Done
Executing queries: [---------------------------------------------------] 100.00%



Website with 'Http20Enabled' Disabled, Severity: LOW, Results: 1
Description: 'Microsoft.Web/sites' should have 'Http20Enabled' enabled
Platform: AzureResourceManager
Learn more about this vulnerability: https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/70111098-7f85-48f0-b1b4-e4261cf5f61b

        [1]: ../../path/main.bicep:24

                023:   location: location
                024:   properties: {
                025:     serverFarmId: appServicePlan.id


Website Azure Active Directory Disabled, Severity: LOW, Results: 1
Description: WebApp should have Azure Active Directory  enabled with 'identity.type' set to 'SystemAssigned' or 'userAssignedIdentities' set to 'true'
Platform: AzureResourceManager
Learn more about this vulnerability: https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/e9c133e5-c2dd-4b7b-8fff-40f2de367b56

        [1]: ../../path/main.bicep:22

                021: resource appService 'Microsoft.Web/sites@2023-12-01' = {
                022:   name: 'app-kicsbiceptest'
                023:   location: location

<省略>

Results Summary:
CRITICAL: 0
HIGH: 1
MEDIUM: 4
LOW: 2
INFO: 0
TOTAL: 7

Generating Reports: Done

{
	"kics_version": "v2.1.2",
	"files_scanned": 1,
	"lines_scanned": 51,
	"files_parsed": 1,
	"lines_parsed": 51,
	"lines_ignored": 0,
	"files_failed_to_scan": 0,
	"queries_total": 43,
	"queries_failed_to_execute": 0,
	"queries_failed_to_compute_similarity_id": 0,
	"scan_id": "console",
	"severity_counters": {
		"CRITICAL": 0,
		"HIGH": 1,
		"INFO": 0,
		"LOW": 2,
		"MEDIUM": 4,
		"TRACE": 0
	},
	"total_counter": 7,
	"total_bom_resources": 0,
	"start": "2024-09-07T06:17:06.321639652Z",
	"end": "2024-09-07T06:17:07.625976814Z",
	"paths": [
		"/path/"
	],
	"queries": [
		{
			"query_name": "Passwords And Secrets - Generic Password",
			"query_id": "487f4be7-3fd9-4506-a07a-eae252180c08",
			"query_url": "https://docs.kics.io/latest/secrets/",
			"severity": "HIGH",
			"platform": "Common",
			"cwe": "798",
			"cloud_provider": "COMMON",
			"category": "Secret Management",
			"experimental": false,
			"description": "Query to find passwords and secrets in infrastructure code.",
			"description_id": "d69d8a89",
			"files": [
				{
					"file_name": "../../path/main.bicep",
					"similarity_id": "0677aef268272d7dd73e6cfc8c341fd72b56fb7def8da5ebc2e523f8d563d058",
					"line": 38,
					"issue_type": "RedundantAttribute",
					"search_key": "",
					"search_line": 0,
					"search_value": "",
					"expected_value": "Hardcoded secret key should not appear in source",
					"actual_value": "Hardcoded secret key appears in source"
				}
			]
		},
<省略>

# スキャン結果をPDF形式で出力する
docker run -t -v ./bicep:/path checkmarx/kics scan --report-formats "pdf" -p /path/ -o "/path/"

# INFOとLOWの重大度を除外してスキャンする
docker run -t -v ./bicep:/path checkmarx/kics scan --exclude-severities 'info,low' -p /path/ -o "/path/"

{
  "path": "bicep_sample",
  "verbose": true,
  "log-file": true,
  "type": "bicep",
  "queries-path": "assets/queries",
  "exclude-paths": [
     "hogehoge/"
  ],
  "output-path": "path"
}

# 設定ファイルを指定してスキャンする
docker run -t -v ./bicep:/path checkmarx/kics scan -p /path/ --config ./bicep/kics-config.json

name: Run KICS
run-name: Run KICS

on: [push]

jobs:
  Explore-GitHub-Actions:
    runs-on: ubuntu-latest
    steps:
        # GitHubリポジトリにアクセス可能にする
        - uses: actions/checkout@v3
        # KICSでIaCをスキャンする
        - name: run kics Scan
          uses: checkmarx/kics-github-action@v2.1.0
          with:
            # bicepフォルダをスキャンする
            path: 'bicep'
            output_path: result/
        # 結果をJSONフォーマットで表示する
        - name: display kics results
          run: |
            cat result/results.json

name: Run KICS
run-name: Run KICS

on: [push]

jobs:
  Explore-GitHub-Actions:
    runs-on: ubuntu-latest
    steps:
        # GitHubリポジトリにアクセス可能にする
        - uses: actions/checkout@v3
        # KICSでIaCをスキャンする
        - name: run kics Scan
          uses: checkmarx/kics-github-action@v2.1.0
          with:
            # bicepフォルダをスキャンする
            path: 'bicep'
            output_path: result/
        # 結果をJSONフォーマットで表示する
        - name: display kics results
          run: |
            cat result/results.json

name: Run KICS
run-name: Run KICS

on: [push]

jobs:
  Explore-GitHub-Actions:
    runs-on: ubuntu-latest
    steps:
        # GitHubリポジトリにアクセス可能にする
        - uses: actions/checkout@v3
        # KICSでIaCをスキャンする
        - name: run kics Scan
          uses: checkmarx/kics-github-action@v2.1.0
          with:
            # bicepフォルダをスキャンする
            path: 'bicep'
            fail_on: high,medium
            output_path: result/
        # 結果をJSONフォーマットで表示する
        - name: display kics results
          run: |
            cat result/results.json