Integrating GCP and Azure misconfig detection support.

[morpheuslord]

Question

How to add support for misconfiguration scanning for Azure and GCP or other cloud providers supported by defsec into trivy to make it into one unified system?

Target

AWS

Scanner

Misconfiguration

Output Format

JSON

Mode

Standalone

Operating System

Linux

Version

Version: 0.56.2

[nikpivkin]

Hi @morpheuslord !

Now defsec is part of Trivy, so Trivy supports everything that defsec does. Here you can find a list of supported providers.

[morpheuslord]

is there any link or guild on how I can run the tests, like adding keys and all that?

[nikpivkin]

https://aquasecurity.github.io/trivy/v0.56/docs/coverage/iac/

[morpheuslord]

not like this similar to how trivy-aws plugin works I wanted to know if anything like that is available, or ways we can implement one?

[simar7]

@morpheuslord are you looking for cloud scanning for Azure and GCP? At the moment we only have trivy-aws as a plugin as you mentioned which does a live scan for AWS Cloud resources.

[morpheuslord]

Yes, I was looking for something similar for Azure and GCP. Trivy has great support for customisation and improvements so I was looking for solutions to integrate that as well.

Is there a way outside trivy some other method I can use to like extract or download the configurations for AWS, Azure and GCP for me to run the trivy iac misconfigs scanner?

[simar7]

Is there a way outside trivy some other method I can use to like extract or download the configurations for AWS, Azure and GCP for me to run the trivy iac misconfigs scanner?

Not sure if I understand your question. As I mentioned, live cloud scanning is only supported for AWS with the trivy-aws plugin. If you're looking to scan just IaC for these clouds, you can refer to the link that @nikpivkin shared earlier.