Skip to content

Commit d0ab51a

Browse files
thpiercethpierce
authored
Add daily security scans with reporting (#139)
In this PR, we are adding a workflow that runs daily and does the following: 1. Scans dependencies with https://github.com/jeremylong/DependencyCheck, looking for any findings. 2. Scans latest released image with https://github.com/aquasecurity/trivy-action, looking for high findings. 2. Scans latest released image with https://github.com/aquasecurity/trivy-action, looking for low findings. 3. Reports scan results in both high and low (DependencyCheck is low, as it is an experimental scanner) to CloudWatch metrics. Testing: https://github.com/aws-observability/aws-otel-python-instrumentation/actions/runs/8546375213/job/23416606146?pr=139 Note that MONITORING_ROLE_ARN won't work from pull requests, but should work in daily runs, as a result, we cannot test metrics are produced until this is merged. By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
1 parent 8888e64 commit d0ab51a

File tree

3 files changed

+129
-71
lines changed

3 files changed

+129
-71
lines changed

‎.github/dependency-check-suppressions.xml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<!--False positive: opentelemetry-exporter-otlp-proto-grpc incorrectly maps to grpc-->
4+
<suppress>
5+
<notes><![CDATA[file name: opentelemetry-exporter-otlp-proto-grpc:1.22.0]]></notes>
6+
<packageUrl regex="true">^pkg:pypi/opentelemetry\-exporter\-otlp\-proto\-grpc@.*$</packageUrl>
7+
<cpe>cpe:/a:grpc:grpc</cpe>
8+
</suppress>
9+
</suppressions>

‎.github/workflows/daily_scan.yml

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
# Performs a daily scan of:
4+
# * The latest released ADOT Python image, using Trivy
5+
# * Project dependencies, using DependencyCheck
6+
#
7+
# Publishes results to CloudWatch Metrics.
8+
name: Daily scan
9+
10+
on:
11+
schedule:
12+
- cron: '0 18 * * *' # scheduled to run at 18:00 UTC every day
13+
workflow_dispatch: # be able to run the workflow on demand
14+
15+
env:
16+
AWS_DEFAULT_REGION: us-east-1
17+
18+
permissions:
19+
id-token: write
20+
contents: read
21+
22+
jobs:
23+
scan_and_report:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout repo for dependency scan
27+
uses: actions/checkout@v4
28+
with:
29+
fetch-depth: 0
30+
31+
- name: Set up Python for dependency scan
32+
uses: actions/setup-python@v4
33+
with:
34+
python-version: "3.10"
35+
36+
- name: Create requirements.txt for dependency scan
37+
run: |
38+
python -m venv env
39+
source env/bin/activate
40+
pip install aws-opentelemetry-distro/
41+
pip freeze > aws-opentelemetry-distro/requirements.txt
42+
less aws-opentelemetry-distro/requirements.txt
43+
44+
- name: Install java for dependency scan
45+
uses: actions/setup-java@v4
46+
with:
47+
java-version: 17
48+
distribution: 'temurin'
49+
50+
- name: Configure AWS credentials for dependency scan
51+
uses: aws-actions/configure-aws-credentials@v4
52+
with:
53+
role-to-assume: ${{ secrets.SECRET_MANAGER_ROLE_ARN }}
54+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
55+
56+
- name: Get NVD API key for dependency scan
57+
uses: aws-actions/aws-secretsmanager-get-secrets@v1
58+
id: nvd_api_key
59+
with:
60+
secret-ids: ${{ secrets.NVD_API_KEY_SECRET_ARN }}
61+
parse-json-secrets: true
62+
63+
# See http://jeremylong.github.io/DependencyCheck/dependency-check-cli/ for installation explanation
64+
- name: Install and run dependency scan
65+
id: dep_scan
66+
if: always()
67+
run: |
68+
gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 259A55407DD6C00299E6607EFFDE55BE73A2D1ED
69+
VERSION=$(curl -s https://jeremylong.github.io/DependencyCheck/current.txt)
70+
curl -Ls "https://github.com/jeremylong/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" --output dependency-check.zip
71+
curl -Ls "https://github.com/jeremylong/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc
72+
gpg --verify dependency-check.zip.asc
73+
unzip dependency-check.zip
74+
./dependency-check/bin/dependency-check.sh --enableExperimental --suppression .github/dependency-check-suppressions.xml --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} -s aws-opentelemetry-distro/
75+
76+
- name: Print dependency scan results on failure
77+
if: ${{ steps.dep_scan.outcome != 'success' }}
78+
run: less dependency-check-report.html
79+
80+
- name: Perform high image scan
81+
if: always()
82+
id: high_scan
83+
uses: ./.github/actions/image_scan
84+
with:
85+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.0.1"
86+
severity: 'CRITICAL,HIGH'
87+
88+
- name: Perform low image scan
89+
if: always()
90+
id: low_scan
91+
uses: ./.github/actions/image_scan
92+
with:
93+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.0.1"
94+
severity: 'MEDIUM,LOW,UNKNOWN'
95+
96+
- name: Configure AWS Credentials for emitting metrics
97+
if: always()
98+
uses: aws-actions/configure-aws-credentials@v4
99+
with:
100+
role-to-assume: ${{ secrets.MONITORING_ROLE_ARN }}
101+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
102+
103+
- name: Publish high scan status
104+
if: always()
105+
run: |
106+
value="${{ steps.high_scan.outcome == 'success' && '1.0' || '0.0' }}"
107+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
108+
--metric-name Success \
109+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=daily_scan_high \
110+
--value $value
111+
112+
# DependencyCheck for Python is experimental and prone to false positives. Until it is stable, use only for low monitoring.
113+
- name: Publish low scan status
114+
if: always()
115+
run: |
116+
value="${{ steps.low_scan.outcome == 'success' && steps.dep_scan.outcome == 'success' && 1.0 || 0.0}}"
117+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
118+
--metric-name Success \
119+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=daily_scan_low \
120+
--value $value

‎.github/workflows/released_image_scan.yml

-71
This file was deleted.

0 commit comments

Comments
 (0)