microsoft / microsoft/security-devops-azdevops

Unable to Authenticate to Private Terraform Module Registry with Checkov

Open
#117 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
86
Forks
22
PR merge metrics
No merged PRs in 30d

Description

I am encountering an issue with the Microsoft Security DevOps task (microsoftsecuritydevops@1) when trying to authenticate to our private Terraform module registry using the Checkov. Although Checkov supports authentication via the "TF_REGISTRY_TOKEN" environment variable, this method does not seem to work within the microsoftsecuritydevops@1 task.

Could you please provide guidance on how to successfully authenticate to a private module registry while using Checkov in this context?

Thank you.

I have tried:
- task: MicrosoftSecurityDevOps@1 displayName: 'Checkov Policy Scanner' inputs: command: run policy: azuredevops tools: checkov break: true publish: true artifactName: CodeAnalysisLogs env: TF_REGISTRY_TOKEN: $(TF_REGISTRY_TOKEN) TF_HOST_NAME: $(TF_HOST_NAME) GDN_CHECKOV_FRAMEWORK: "terraform" GDN_CHECKOV_DOWNLOADEXTERNALMODULES: "true"

and also tried:
- task: MicrosoftSecurityDevOps@1 displayName: 'Checkov Policy Scanner' inputs: command: run policy: azuredevops tools: checkov break: true publish: true artifactName: CodeAnalysisLogs env: GDN_CHECKOV_TF_REGISTRY_TOKEN: $(TF_REGISTRY_TOKEN) GDN_CHECKOV_TF_HOST_NAME: $(TF_HOST_NAME) GDN_CHECKOV_FRAMEWORK: "terraform" GDN_CHECKOV_DOWNLOADEXTERNALMODULES: "true"

But nothing seems to work. If Checkov is replacing Terrascan as the default IaC code analysis tool for microsoftsecuritydevops@1, then this feature is extremely important.

Terrascan has the GDN_TERRASCAN_USETERRAFORMCACHE to authenticate using the terraform init cache for remote modules.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository files, tests, or entry points are named. Start by reproducing the supplied MicrosoftSecurityDevOps@1 YAML with Checkov and compare how each environment variable is passed to the task. Done means the task can authenticate to the private Terraform module registry and scan the external modules successfully.

Written by the indexing model from the issue text.

Assessment

Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.