feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots #3284

tockn · 2022-12-10T07:47:48Z

Description

Hi. Thank you for such a wonderful product!

VM scanning is performed in the current implementation using default region settings read from environment variables, etc. The only way to scan for EBS snapshots (or AMIs) in any region was probably to dynamically change the AWS_REGION environment variable.
Therefore, in this pr, I have implemented the --region option so that EBS snapshots and AMIs can be fetched by specifying any region.

This is just a personal usage that I implemented on my own, so if you have a different idea, please close this pr!

Related issues

N/A

before

❯ trivy vm ebs:snap-xxxxxxxxxxxx
2022-12-10T16:07:11.899+0900    INFO    Vulnerability scanning is enabled
2022-12-10T16:07:11.901+0900    INFO    Secret scanning is enabled
2022-12-10T16:07:11.901+0900    INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-12-10T16:07:11.901+0900    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection
2022-12-10T16:07:12.098+0900    FATAL   vm scan error: scan error: scan failed: failed analysis: EBS open error: EBS error: operation error EBS: ListSnapshotBlocks, https response error StatusCode: 404, RequestID: ---------------, ResourceNotFoundException: The snapshot 'snap-xxxxxxxxxxxx' does not exist.

after

❯ trivy vm --region us-west-2 ebs:snap-xxxxxxxxxxxx
2022-12-10T16:26:03.407+0900    INFO    Vulnerability scanning is enabled
2022-12-10T16:26:03.409+0900    INFO    Secret scanning is enabled
2022-12-10T16:26:03.409+0900    INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-12-10T16:26:03.409+0900    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection
....

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

CLAassistant · 2022-12-10T07:47:58Z

All committers have signed the CLA.

CLAassistant · 2022-12-10T07:47:59Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

knqyf263 · 2022-12-11T08:28:21Z

pkg/flag/vm_flags.go

@@ -0,0 +1,38 @@
+package flag


Could you use AWSFlagGroup instead?

trivy/pkg/flag/aws_flags.go

Lines 36 to 42 in f369bd3

type AWSFlagGroup struct {

Region *Flag

Endpoint *Flag

Services *Flag

Account *Flag

ARN *Flag

}

knqyf263 · 2022-12-11T08:33:28Z

docs/docs/vm/aws.md

+If you want to scan a AMI of non-default setting region, you can set any region via `--region` option.
+
+```shell
+$ trivy vm --region ap-northeast-1 ami:ami-0123456789abcdefg


VM scanning is not dedicated to AWS. We will probably add support for GCP and Azure.

Suggested change

$ trivy vm --region ap-northeast-1 ami:ami-0123456789abcdefg

$ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg

knqyf263 · 2022-12-11T08:33:35Z

docs/docs/vm/aws.md

@@ -52,6 +58,13 @@ $ trivy vm --security-checks vuln ebs:snap-0123456789abcdefg
 !!! tip
 The scanning could be faster if you enable only vulnerability scanning (`--security-checks vuln`) because Trivy tries to download only necessary blocks for vulnerability detection.

+If you want to scan an EBS Snapshot of non-default setting region, you can set any region via `--region` option.


knqyf263 · 2022-12-11T08:34:13Z

pkg/commands/app.go

@@ -884,6 +884,7 @@ func NewVMCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 		ScanFlagGroup:          flag.NewScanFlagGroup(),
 		SecretFlagGroup:        flag.NewSecretFlagGroup(),
 		VulnerabilityFlagGroup: flag.NewVulnerabilityFlagGroup(),
+		VMFlagGroups:           flag.NewVMFlagGroup(),


You can define a custom flag as below.

awsFlagGroup := flag.AWSFlagGroup{ Region: flag.Flag{ Name: "aws-region", ConfigName: "aws.region", Value: "", Usage: "AWS region to scan", } }

The following variable should be exported so it could be reused. I'll refactor that later.

trivy/pkg/flag/aws_flags.go

Lines 4 to 9 in f369bd3

awsRegionFlag = Flag{

Name: "region",

ConfigName: "cloud.aws.region",

Value: "",

Usage: "AWS Region to scan",

}

Co-authored-by: Teppei Fukuda <[email protected]>

tockn · 2022-12-12T15:50:40Z

@knqyf263 Thank you for reviewing! I've fixed those points.

knqyf263 · 2022-12-15T10:21:23Z

Thanks for your contribution!

tockn added 3 commits December 10, 2022 15:54

feat: add vm scan aws region flag

fc79e4e

feat: import vm options

a833315

docs: update vm docs

8430fd7

tockn requested a review from knqyf263 as a code owner December 10, 2022 07:47

knqyf263 reviewed Dec 11, 2022

View reviewed changes

tockn and others added 4 commits December 13, 2022 00:35

Update docs/docs/vm/aws.md

04769e1

Co-authored-by: Teppei Fukuda <[email protected]>

doc: region -> aws-region

4c17253

refactor: using AWSFlagGroup instead of VMFlagGroup

bd66e07

doc: region -> aws-region

a7abdb6

knqyf263 approved these changes Dec 15, 2022

View reviewed changes

knqyf263 merged commit e92266f into aquasecurity:main Dec 15, 2022

knqyf263 mentioned this pull request May 24, 2023

AWS ECR registry authentication only works in the same/default region as caller #1026

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots #3284

feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots #3284

tockn commented Dec 10, 2022 •

edited

Loading

CLAassistant commented Dec 10, 2022 •

edited

Loading

CLAassistant commented Dec 10, 2022

knqyf263 Dec 11, 2022

knqyf263 Dec 11, 2022

knqyf263 Dec 11, 2022

knqyf263 Dec 11, 2022

tockn commented Dec 12, 2022

knqyf263 commented Dec 15, 2022

	type AWSFlagGroup struct {
	Region *Flag
	Endpoint *Flag
	Services *Flag
	Account *Flag
	ARN *Flag
	}

	$ trivy vm --region ap-northeast-1 ami:ami-0123456789abcdefg
	$ trivy vm --aws-region ap-northeast-1 ami:ami-0123456789abcdefg

	awsRegionFlag = Flag{
	Name: "region",
	ConfigName: "cloud.aws.region",
	Value: "",
	Usage: "AWS Region to scan",
	}

feat(vm): add region option to vm scan to be able to scan any region's ami and ebs snapshots #3284

feat(vm): add region option to vm scan to be able to scan any region's ami and ebs snapshots #3284

Conversation

tockn commented Dec 10, 2022 • edited Loading

Description

Related issues

before

after

Checklist

CLAassistant commented Dec 10, 2022 • edited Loading

CLAassistant commented Dec 10, 2022

knqyf263 Dec 11, 2022

Choose a reason for hiding this comment

knqyf263 Dec 11, 2022

Choose a reason for hiding this comment

knqyf263 Dec 11, 2022

Choose a reason for hiding this comment

knqyf263 Dec 11, 2022

Choose a reason for hiding this comment

tockn commented Dec 12, 2022

knqyf263 commented Dec 15, 2022

feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots #3284

feat(vm): add `region` option to vm scan to be able to scan any region's ami and ebs snapshots #3284

tockn commented Dec 10, 2022 •

edited

Loading

CLAassistant commented Dec 10, 2022 •

edited

Loading