Transcript
that. Let's clear here and look at our TFSEC guide here. So the command that you'd run for TFSEC is very simple. You just run TFSEC and then the directory that you want to scan. So in this case we are going to scan the Terraform directory. So once again here we go we got our TFSEC output and you can see that it gives you a summary, a nice summary at the very end. It tells you the results so we've got six past policies, zero ignored, five critical, 18 high, four medium and six low. So a total of 33 potential problems have been detected and this is all open source out of the box. There is no API or anything like that that I'm running so that is available completely open source. Now you can see each one of those policies, you can see the results, low security, this is a low vulnerability, security group rule does not have a description and gives you the file, exactly the location, an ID for this check, the impact, the resolution, add descriptions for all security group rules. So it's a nice touch here giving you the resolution right in the CLI and of course more information. And TFSEC is backed by Aqua security so you can see some of the docs have Aqua security in it right here and you can follow these links for more information. Now you can also similar to what we saw with checkoff, you can specify a particular output format. So in this case we are going to output everything in JSON as you can see here. And you can also exclude certain checks by specifying the check ID as shown in this command. So I can go ahead and run this command with the exclude flag and exclude a particular check and now we can see that we've ignored two checks right here. Okay and now we have only 31 potential problems. Alright so that's it for the built-in policies by TFSEC. Now let's take a look at a custom policy and we're going to do the same thing we did with checkoff. So basically the exact same scenario where we have a an S3 bucket that has a PCI requirement with scope PCI that tag we saw and also we have the public read in the ACL of that S3 bucket. So once again we can just run this and TFSEC against the Terraform folder and let's look for this PCI policy tfchecks.yaml in the .tfsec folder. So by default if you create a .tfsec folder inside the the folder that you're scanning which is the Terraform folder, it's going to create or you can put the PCI policy here that we just mentioned. So any custom policies that are here will be scanned automatically by .tfsec. And this is using YAML. There are two ways of using custom policy with .tfsec. You can use YAML or a Rego policy or Rego. It's spelled R-E-G-O but it's pronounced Rego from OPA. In this case I opted to use a YAML. It could be YAML or it could be JSON. I'm using YAML here and I give it the code or the check ID if you will of custom or CUS999 and give it a description. Make sure S3 bucket ACL is not public read if it has a scope equals to PCI tag. You can give it an impact, a message, a resolution. The required type is resource. The required label is AWS S3 bucket. Severity in this case I chose critical. And a match spec. So we're matching if any of these happen. So if it doesn't contain tags with the key scope and the value PCI or if it doesn't contain an ACL with a value of public read. So we're actually looking for this to pass right. So if any of this doesn't contain tags or it doesn't contain this public read it will pass the check right. So you got to think of it in the opposite way. And now if I go ahead and search for 999 I will see here we go our custom CUS999 check has failed and it's a critical check and the message that we put it in the description here shows up as well. And here is our resource and once again the particular file and so on. So this is how you create a custom check or custom policy inside of TFSEC.
