mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-12 15:50:15 -08:00
fix: update all documentation links (#9777)
This commit is contained in:
@@ -66,7 +66,7 @@ If you'd like to learn more or request a demo, [click here to contact us](./cont
|
||||
|
||||
| Feature | Trivy OSS | Aqua |
|
||||
| --- | --- | --- |
|
||||
| Infrastructure as Code (IaC) | Many popular languages as detailed [here](https://trivy.dev/latest/docs/scanner/misconfiguration/check/builtin/) | In addition, Build Pipeline configuration scanning |
|
||||
| Infrastructure as Code (IaC) | Many popular languages as detailed [here](https://trivy.dev/docs/latest/scanner/misconfiguration/check/builtin/) | In addition, Build Pipeline configuration scanning |
|
||||
| Checks customization | Create custom checks with Rego | Create custom checks in no-code interface <br> Customize existing checks with organizational preferences |
|
||||
| Cloud scanning | AWS (subset of services) | AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud |
|
||||
| Compliance frameworks | CIS, NSA, vendor guides | More than 25 compliance programs |
|
||||
|
||||
@@ -24,7 +24,7 @@ There are 4 categories:
|
||||
If you find any false positives or false negatives, please make sure to report them under the "False Detection" category, not "Bugs".
|
||||
|
||||
## False detection
|
||||
Trivy depends on [multiple data sources](https://trivy.dev/latest/docs/scanner/vulnerability/#data-sources).
|
||||
Trivy depends on [multiple data sources](https://trivy.dev/docs/latest/scanner/vulnerability/#data-sources).
|
||||
Sometime these databases contain mistakes.
|
||||
|
||||
If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Custom Checks with Rego
|
||||
|
||||
Trivy can scan configuration files for common security issues (a.k.a IaC misconfiguration scanning). In addition to a comprehensive built in database of checks, you can add your own custom checks. Checks are written in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) language and the full documentation for checks and customizing them is available [here](https://trivy.dev/latest/docs/scanner/misconfiguration/custom/).
|
||||
Trivy can scan configuration files for common security issues (a.k.a IaC misconfiguration scanning). In addition to a comprehensive built in database of checks, you can add your own custom checks. Checks are written in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) language and the full documentation for checks and customizing them is available [here](https://trivy.dev/docs/latest/scanner/misconfiguration/custom/).
|
||||
|
||||
This tutorial will walk you through writing a custom check in Rego that checks for an issue in a Dockerfile.
|
||||
|
||||
@@ -38,7 +38,7 @@ Next, we need to specify metadata about the check. This is information that help
|
||||
|
||||
Important: The `METADATA` has to be defined on top of the file.
|
||||
|
||||
More information on the different fields in the metadata can be found in the [Trivy documentation.](https://trivy.dev/latest/docs/scanner/misconfiguration/custom/)
|
||||
More information on the different fields in the metadata can be found in the [Trivy documentation.](https://trivy.dev/docs/latest/scanner/misconfiguration/custom/)
|
||||
|
||||
## Package and imports
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ We have been consolidating all of our scanning-related efforts in one place, and
|
||||
|
||||
## Trivy Config Command
|
||||
|
||||
Terraform configuration scanning is available as part of the `trivy config` command. This command scans all configuration files for misconfiguration issues. You can find the details within [misconfiguration scans in the Trivy documentation.](https://trivy.dev/latest/docs/scanner/misconfiguration/)
|
||||
Terraform configuration scanning is available as part of the `trivy config` command. This command scans all configuration files for misconfiguration issues. You can find the details within [misconfiguration scans in the Trivy documentation.](https://trivy.dev/docs/latest/scanner/misconfiguration/)
|
||||
|
||||
Command structure:
|
||||
```
|
||||
@@ -23,7 +23,7 @@ The `trivy config` command can scan Terraform configuration, CloudFormation, Doc
|
||||
- If the configuration that has been defined does not follow best practices, the check will fail.
|
||||
|
||||
### Prerequisites
|
||||
Install Trivy on your local machines. The documentation provides several [different installation options.](https://trivy.dev/latest/getting-started/installation/)
|
||||
Install Trivy on your local machines. The documentation provides several [different installation options.](https://trivy.dev/docs/latest/getting-started/installation/)
|
||||
This tutorial will use this example [Terraform tutorial](https://github.com/Cloud-Native-Security/trivy-demo/tree/main/bad_iac/terraform) for terraform misconfiguration scanning with Trivy.
|
||||
|
||||
Git clone the tutorial and cd into the directory:
|
||||
@@ -83,14 +83,14 @@ trivy config --severity CRITICAL, MEDIUM terraform-infra
|
||||
|
||||
### Passing tf.tfvars files into `trivy config` scans
|
||||
|
||||
You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided [in the documentation.](https://trivy.dev/latest/docs/coverage/iac/terraform/#value-overrides)
|
||||
You can pass terraform values to Trivy to override default values found in the Terraform HCL code. More information are provided [in the documentation.](https://trivy.dev/docs/latest/coverage/iac/terraform/#value-overrides)
|
||||
|
||||
```
|
||||
trivy config --tf-vars terraform.tfvars ./
|
||||
```
|
||||
### Custom Checks
|
||||
|
||||
We have lots of examples in the [documentation](https://trivy.dev/latest/docs/scanner/misconfiguration/custom/) on how you can write and pass custom Rego checks into terraform misconfiguration scans.
|
||||
We have lots of examples in the [documentation](https://trivy.dev/docs/latest/scanner/misconfiguration/custom/) on how you can write and pass custom Rego checks into terraform misconfiguration scans.
|
||||
|
||||
## Secret and vulnerability scans
|
||||
|
||||
@@ -100,15 +100,15 @@ The `trivy config` command does not perform secret and vulnerability checks out
|
||||
trivy fs --scanners secret,misconfig ./
|
||||
```
|
||||
|
||||
The `trivy config` command is a sub-command of the `trivy fs` command. You can learn more about this command in the [documentation.](https://trivy.dev/latest/docs/target/filesystem/)
|
||||
The `trivy config` command is a sub-command of the `trivy fs` command. You can learn more about this command in the [documentation.](https://trivy.dev/docs/latest/target/filesystem/)
|
||||
|
||||
## Scanning Terraform Plan files
|
||||
|
||||
Instead of scanning your different Terraform resources individually, you could also scan your Terraform Plan file before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. [Here](https://trivy.dev/latest/docs/coverage/iac/terraform/#terraform) is the link to the documentation.
|
||||
Instead of scanning your different Terraform resources individually, you could also scan your Terraform Plan file before it is deployed for misconfiguration. This will give you insights into any misconfiguration of your resources as they would become deployed. [Here](https://trivy.dev/docs/latest/coverage/iac/terraform/#terraform) is the link to the documentation.
|
||||
|
||||
Note that you need to be able to create a terraform init and plan without any errors.
|
||||
|
||||
## Using Trivy in your CI/CD pipeline
|
||||
Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: [https://trivy.dev/latest/tutorials/integrations/](https://trivy.dev/latest/tutorials/integrations/)
|
||||
Similar to tfsec, Trivy can be used either on local developer machines or integrated into your CI/CD pipeline. There are several steps available for different pipelines, including GitHub Actions, Circle CI, GitLab, Travis and more in the tutorials section of the documentation: [https://trivy.dev/docs/latest/tutorials/integrations/](https://trivy.dev/docs/latest/tutorials/integrations/)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user