IaC Connectivity Risk Analysis

Do the following:

1. If you don’t have a GitLab account, create one now.

2. Log in to CloudFlow as user admin. Make sure to write down the tenant ID you are using for later on in this procedure.

3. Add a new API Access Key. See Add a new API Access Key.

4. Click on the vertical ellipsis ( ) to the right of the newly created access key.

5. On the options pop-up menu that is displayed, click View. Save the Client ID and Client Secret for later on in this procedure.

   

6. Log in to GitLab.

7. Create a GitLab personal access token:

   1. In GitLab, select your avatar in the upper right-hand corner.

   2. Select Edit profile.

   3. On the left sidebar, Select Access Tokens. The Personal Access Tokens screen appears.

      

   4. Add a Token name and optional Expiry date for the token.

   5. Select the API checkbox.

   6. Click Create personal access token. Your access token appears.

   7. Copy your new personal access token and save it for later.

   To create a Project Access Token

8. In the GitLab left sidebar, select Settings > CI/CD. The CI/CD Settings appear.

   

9. Expand the Variables section. Click Add variable and add the following keys and their values:

   Repository Secrets:

   Key	Description	Required
   GITLAB_TOKEN	GitLab PaT for checking diffs and adding comments to Merge Requests	Yes
   CF_TENANT_ID	CloudFlow Tenant ID	Yes
   CF_CLIENT_ID	CloudFlow Client ID	Yes
   CF_CLIENT_SECRET	CloudFlow Client Secret	Yes

   Add from the following list, the keys associated with the vendor you are using:

   Cloud Provider Secrets:

   Key	Description	Required	Type
   AWS
   AWS_ACCESS_KEY_ID	AWS Access Key ID	Yes (for AWS)	String
   AWS_SECRET_ACCESS_KEY	AWS Secret Access Key	Yes (for AWS)	String
   Azure
   ARM_SUBSCRIPTION_ID	Azure Subscription ID	Yes (for Azure)	String
   ARM_TENANT_ID	Azure Tenant ID	Yes (for Azure)	String
   ARM_CLIENT_ID	Azure Access Client ID	Yes (for Azure)	String
   ARM_CLIENT_SECRET	Azure Client Secret	Yes (for Azure)	String
   Google Cloud
   GOOGLE_APPLICATION_CREDENTIALS	Google's Cloud Credentials	Yes (for Google Cloud)	JSON

10. In your GitLab Repository, add the iac-connectivity-risk-analysis job in the .gitlab-ci.yml file. You can add it to the stage you choose. In this example the IaC connectivity risk analysis is added to the test stage:

    stages:
      - test
    iac-connectivity-risk-analysis:
      stage: test
      image: public.ecr.aws/algosec/connectivity-risk-analysis:latest
      rules:
        - if: $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH
      script:
        - iac-risk-analysis
    

11. Additional Parameters (Optional)

    There are a few additional parameters that can customize the IaC Connectivity Risk Analysis job. These can be specified in the .gitlab-ci.yml file as job variables (example below):

    Additional Parameters

    Key	Description	Required	Default Value
    CF_REGION	CloudFlow Region us/anz/eu	No	us
    FULL_ANALYSIS	Run checks on all folders with relevant file types	No	false
    STOP_WHEN_FAIL	The check will fail in case any risks are found	No	true
    TF_VERSION	Specify the Terraform version to use (e.g. 1.4.5)	No	latest

    The following example shows how to add these variables to the job definition: In this case, the CloudFlow tenant is in the ANZ region, and you want to run a full analysis (instead of analyzing only changed files in your Merge Request):

    stages:
      - test
    iac-connectivity-risk-analysis:
      stage: test
      image: public.ecr.aws/algosec/connectivity-risk-analysis:latest
      rules:
        - if: $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH
      variables:
        CF_REGION: "anz"
        FULL_ANALYSIS: "true"
      script:
        - iac-risk-analysis