Scanning for AWS Security Issues with Trivy

Scanning for AWS Security Issues with Trivy(lia.mg)

82 points by pcw888 3 years ago | 15 comments

Readers may also enjoy Steampipe [1]. It's an open source "ops as code" CLI to query 83+ services with SQL (AWS, GitHub, Terraform, etc) that comes with hundreds of ready to use benchmarks (CIS, NIST, Cost) and dashboards built in HCL. The AWS Compliance mod [2] and Trivy plugin [3] are specific examples. (Disclaimer - I'm a lead on the project.)

1 - https://steampipe.io 2 - https://hub.steampipe.io/mods/turbot/aws_compliance 3 - https://hub.steampipe.io/plugins/turbot/trivy

bearjaws 3 years ago | |

This is genuinely badass, this would have solved so many head aches in my career with AWS.

Searching / filtering for resources in AWS SDK has always been cludgy and limited, sometimes requiring querying and then filtering locally to find specific records.

Also love the pro-SQL approach.

yevpats 3 years ago |

Shameless plug, you can also enjoy CloudQuery (https://github.com/cloudquery/cloudquery) where we take a more ELT approach so you can use plain SQL for policies (https://github.com/cloudquery/cloudquery/tree/main/plugins/s...) and then use any BI tools for visualization and monitoring (https://github.com/cloudquery/cloudquery/tree/main/plugins/s...).

Shout out to steampipe bellow as a similar project though that takes a more real-time approach rather then ELT which has it's use-cases as well.

bearjaws 3 years ago |

Why not use AWS Security Hub? It already supports reading in all your accounts into a centralized report and running it against multiple standards.

You do pay for it (~$30 a month for my job) but you quite literally check a box and have no setup.

wronglebowski 3 years ago | |

I'm a big fan of Security Hub, it's a great tool for smaller shops to have better native visibility in their environment.

My main issue with it is the standards, PCI, AWS Foundations. These all have "Versions" which aren't controllable. For example AWS Foundations has been at 1.0.0 for over two years, despite receiving several updates and changes over time.

politelemon 3 years ago |

This doesn't make sense to me but probably because I've not understood trivy. Inspecting file type things (docker, file, terraform) was what trivy had been doing so far. This however is now a network inspection and doesn't feel like it fits?

raesene9 3 years ago | |

So in theory this can fit pretty well, if you look it as a tool that can scan things at various stages of the development pipeline. As the rulesets are the same this means you can get consistent results when scanning your terraform and then in production against the running resources.

If it works then it can solve a big problem in security scanning which is different tools applying different rules, which causes frustration as it reduces the risk of "it passed in dev, why is is failing in prod"

(full disclosure, I used to work for Aqua who make Trivy)

pritambarhate 3 years ago |

Just tried it

./trivy aws --region us-east-1

panic: runtime error: invalid memory address or nil pointer dereference

Posted a Github issue as well

itaysk 3 years ago | |

can you please try with v0.31.2?

FujiApple 3 years ago |

TIL: https://github.com/rust-secure-code/cargo-auditable

InfoSecErik 3 years ago |

Alternate tool in the same space: https://github.com/nccgroup/ScoutSuite

user3939382 3 years ago |

Also this https://www.fugue.co/ I learned about this tool by interviewing with them. Nice guys.

u1tron 3 years ago |

AWS has on it's one own native tool to scan the images.

bfung 3 years ago | |

One use case using trivy is in a CI/CD pipeline; fail container builds that have issues to begin with.

Whereas container scanning in ECR, who knows when someone will actually fix the issue.

coredog64 3 years ago | | |

There’s a fix for this. Assign production “visas” to specific image builds. The visa has a clear start and end date and can be renewed if evidence is provided that no security issues above a defined threshold are present.

That said, I really like Trivy. It has native output template support meaning you can plug it in where licensing gets trick (looking at you, Palo Alto Networking).