Skip to content

Bump the azure group with 1 update #4

Bump the azure group with 1 update

Bump the azure group with 1 update #4

Workflow file for this run

name: CIS-AZURE-CI
on:
# TODO: Remove after testing
workflow_dispatch:
inputs:
pull_request_target:
branches:
- main
- "[0-9]+.[0-9]+"
types: [opened, synchronize, reopened]
jobs:
Run-CSPM-AZURE-Tests:
name: CIS AZURE integration test
runs-on: ubuntu-22.04
timeout-minutes: 60
permissions:
contents: "read"
id-token: "write"
steps:
- name: Check out the repo
uses: actions/checkout@v4
- name: Init Hermit
run: ./bin/hermit env -r >> $GITHUB_ENV
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.9"
- name: Install Poetry
run: |
curl -sSL https://install.python-poetry.org | python3 -
poetry --version
- name: Build cloudbeat binary
uses: magefile/mage-action@v3
with:
version: latest
args: build
- name: Run Elasticsearch
uses: elastic/elastic-github-actions/elasticsearch@master
with:
stack-version: ${{ env.ELK_VERSION }}
security-enabled: false
- name: Elasticsearch disable dynamic mapping for findings
run: |
curl -s -XPUT http://localhost:9200/_index_template/common_template -H 'Content-Type: application/json' -d '{ "index_patterns": ["logs-cloud_security_posture.findings*"], "priority": 500, "template": { "mappings": { "dynamic": false, "properties": { "resource": { "dynamic": false, "properties": { "type": { "type": "keyword" } } }, "result": { "dynamic": false, "properties": { "evaluation": { "type": "keyword" } } }, "rule": { "dynamic": false, "properties": { "benchmark": { "dynamic": false, "properties": { "id": { "type": "keyword" } } }, "tags": { "type": "keyword" } } }, "agent": { "dynamic": false, "properties": { "id": { "type": "keyword" }, "version": { "type": "keyword" } } }, "@timestamp": { "type": "date" } } } } }'
- name: Run cloudbeat in background
env:
ES_HOST: http://localhost:9200
ES_USERNAME: elastic
ES_PASSWORD: changeme
AZURE_ACCOUNT_TYPE: single-account
AZURE_CREDENTIALS_TYPE: service_principal_with_client_secret
AZURE_CLIENT_ID: ${{ fromJSON(secrets.AZURE_CREDENTIALS).clientId }}
AZURE_TENANT_ID: ${{ fromJSON(secrets.AZURE_CREDENTIALS).tenantId }}
AZURE_CLIENT_SECRET: ${{ fromJSON(secrets.AZURE_CREDENTIALS).clientSecret }}
run: |
./cloudbeat -c deploy/azure/cloudbeat-azure.yml -d '*' &
- name: Wait for cloudbeat to send events
run: sleep 264
- name: Check for findings
working-directory: ./tests
env:
USE_K8S: false
run: |
poetry install
poetry run pytest -k "azure" --alluredir=./allure/results/ --clean-alluredir
- name: Print cloudbeat logs
if: always()
run: |
cat logs/cloudbeat*